{
  "id": "bundle--27111169-e801-4cf1-bf41-14a63ce9a5a6",
  "objects": [
    {
      "created": "2026-03-01T08:10:11.652Z",
      "created_by_ref": "identity--ab072f15-9b87-4ee1-898f-b584d41f29b0",
      "description": "Rolling monthly view of source IPv4 addresses that triggered Suricata severity 1\u20132 (high & medium) IDS alerts on a T-Pot honeypot. Each run looks back the last 1h and appends newly seen IPs for this month. Location: Australia.",
      "id": "report--27111169-e801-4cf1-bf41-14a63ce9a5a6",
      "labels": [
        "threat-report"
      ],
      "modified": "2026-03-30T12:10:01.752Z",
      "name": "Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "object_refs": [
        "identity--ab072f15-9b87-4ee1-898f-b584d41f29b0",
        "indicator--3c74c21c-43b7-4b12-a531-4d71726ce6cb",
        "indicator--ea6d0784-da74-49c3-a72d-44bf18f18c48",
        "indicator--4813eb01-f97e-4b5c-83c8-43d7afa8d630",
        "indicator--9643b8fa-0099-4dd7-8b29-4fcd4228e265",
        "indicator--ab63a9c0-402b-42c2-a4d4-0e2d31a612e6",
        "indicator--b62a469f-c141-45e4-83e6-4396426f80e5",
        "indicator--e2f23984-6a6d-480c-9808-5d45553dc0aa",
        "indicator--b0efaae3-de8a-4427-ac24-07517bf9df9a",
        "indicator--3f191ee3-2afd-4aa2-9b01-51b0b2590ad8",
        "indicator--c7a3fedd-5a4c-4958-b42f-ca85be8f21f6",
        "indicator--57489dca-195c-47b2-8653-8c63d2512424",
        "indicator--af560a6f-463d-4e82-9589-244e2f3f2e2c",
        "indicator--198cd619-fcc0-46dd-b437-00f6f118292d",
        "indicator--f5a37c75-8cde-4507-afb7-2f2e53770137",
        "indicator--aa20c80c-fa88-4888-bc59-a32870d420c7",
        "indicator--0947eb8e-72d1-41da-8a07-47349638b117",
        "indicator--fb0ec68d-1cd6-4b6a-a19a-c3dccd0a9c08",
        "indicator--5972004f-5a21-4c3e-ab9b-8701b4e6301e",
        "indicator--1607f6d8-4c37-4849-92e6-280eca3a0b2e",
        "indicator--bdc50673-197a-4f0f-841c-1ffb9a431cd5",
        "indicator--dacc2c77-7176-4bf2-bbef-e4f8fb424478",
        "indicator--cbc2dc3f-af07-4937-b481-1db3e969a2a7",
        "indicator--1c1f6392-9f4d-4cd6-b996-f0617f154ddc",
        "indicator--cf3bb937-4767-4f47-893d-e7069da7c960",
        "indicator--fe7064a0-58f8-4d98-a235-651259f3f738",
        "indicator--c9469108-649b-4089-ac01-8aec7dbb7d18",
        "indicator--e931d0de-9381-4bd4-b014-e7a778ae74aa",
        "indicator--8529e467-988c-44a7-845f-858b57d289c9",
        "indicator--367b9804-baf1-41e2-8766-9a3e854a0b34",
        "indicator--95ad3ab5-7bfe-4e5b-bdd4-b09c7fa7cef1",
        "indicator--9f36a1a4-3f8d-428d-aa06-02b816510394",
        "indicator--46c251fb-2f4c-44d7-96c4-5266f23bd3fb",
        "indicator--ffd34c3e-2b91-4539-a374-2b122262ecbd",
        "indicator--089bbd09-9790-4f62-a32c-6444760cd017",
        "indicator--e051f103-82a9-4596-875b-380594801a83",
        "indicator--67c6373f-0ac6-4072-8b26-19900889192d",
        "indicator--502473cf-ad49-4840-b05d-a51cf39c3dd6",
        "indicator--5ed391d6-686a-49ec-b900-de578c232106",
        "indicator--45b2a7df-3ecc-4d49-a75a-f8dc5467fdb1",
        "indicator--c6b4e154-80bf-4f1d-ae8d-84e6323beeb2",
        "indicator--dce2e845-d2b8-4254-a9ef-b8a12a069c05",
        "indicator--8147baa3-959e-427b-be0d-fd6ab972612a",
        "indicator--0aa77709-ecaa-44e3-9d54-34444ef563e1",
        "indicator--6592e9e6-b693-49d3-ac17-8bbb1805adad",
        "indicator--e6dd8d7a-bdf2-45fc-902b-2cfa55665cdd",
        "indicator--c976187d-1d64-4108-8a25-53ec27b62a08",
        "indicator--a93886f8-a4d3-44d0-8db4-5fe153b32d81",
        "indicator--4b2fad99-25ea-44be-8693-c5c3c58de197",
        "indicator--1425d6d8-fd61-4b5d-8ea7-69eb03df349c",
        "indicator--62c6db36-0b1c-436b-94bc-25c08dad14a8",
        "indicator--82b36727-89cb-4e0c-9280-dc6237592bb2",
        "indicator--b6a64034-5586-4b06-a212-7a0435157d59",
        "indicator--9cc76ee7-621a-48f6-8d10-b383284af91e",
        "indicator--39836e0b-f26f-4ece-a2d3-90fca6b2ff95",
        "indicator--c62bf109-2c67-478c-826a-4dfba5046d65",
        "indicator--5a73be80-a0b2-4b22-99f0-c39bcb3213ed",
        "indicator--710f54b9-c5f6-4439-a5f7-9742751ca730",
        "indicator--24114656-974f-4e17-8b7c-fd30a130ee59",
        "indicator--6a3056a5-48c5-460f-aacc-f21718be66cb",
        "indicator--8ab848d7-9d8c-4333-b9c6-4a0958cd2d95",
        "indicator--d2a9b7d8-c22a-42e8-a155-99d0ed9dab29",
        "indicator--000c089b-f943-4d68-a9f1-a16a60aab744",
        "indicator--dca05bbe-d570-421e-b9e5-8c24ef894304",
        "indicator--144c9e78-db49-4b58-bc4d-494547409220",
        "indicator--4671104c-2e18-4bce-a9ba-3f2c033a777b",
        "indicator--16a07ca9-2875-4875-9f88-943487e3d8d4",
        "indicator--48ffadd0-e0fb-42fd-ba09-8b128deb1996",
        "indicator--1b03367d-f312-41c2-91e5-6625ab01f098",
        "indicator--32e788f1-d7d8-4ca6-bc08-d5283868f023",
        "indicator--43056aad-e909-4296-81c5-785d6f16b53e",
        "indicator--c2d5f91d-ee4e-49b8-b119-7b4a69cd74de",
        "indicator--81e13fb5-c612-40e8-9d0c-4c4a2d4fdfc9",
        "indicator--20fa9b81-d28e-4865-a0af-a746004c88f5",
        "indicator--734ad28b-c2d4-4664-89ca-494ffa3ba246",
        "indicator--db58cf0f-6f43-45ed-b967-eea852c0b3b0",
        "indicator--f6d89430-1184-480e-a5c3-faf5f2a4b700",
        "indicator--96a4d4da-f6d6-46e0-acae-60a37dedc628",
        "indicator--c2956aa6-5da3-4529-811e-ca749c4ac9de",
        "indicator--cf9ac611-b45e-4774-8143-522675fcda19"
      ],
      "published": "2026-03-01T08:10:11.652Z",
      "spec_version": "2.1",
      "type": "report"
    },
    {
      "contact_information": "https://otx.alienvault.com/",
      "created": "2026-03-01T08:10:11.652Z",
      "id": "identity--ab072f15-9b87-4ee1-898f-b584d41f29b0",
      "identity_class": "organization",
      "modified": "2026-03-01T08:10:11.652Z",
      "name": "Open Threat Exchange",
      "spec_version": "2.1",
      "type": "identity"
    },
    {
      "created": "2026-03-01T08:10:12.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--3c74c21c-43b7-4b12-a531-4d71726ce6cb",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-03-01T08:10:12.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T08:10:12.000Z",
      "valid_until": "2026-04-02T08:10:10.000Z"
    },
    {
      "created": "2026-03-01T19:10:13.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=2; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible VXWORKS Urgent11 RCE Attempt - Illegal Urgent Flag; ET EXPLOIT Possible VXWORKS Urgent11 RCE Attempt - Urgent Flag; ports=4360; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--ea6d0784-da74-49c3-a72d-44bf18f18c48",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-03-01T19:10:13.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.34.85.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T19:10:13.000Z",
      "valid_until": "2026-04-02T19:10:12.000Z"
    },
    {
      "created": "2026-03-01T22:10:13.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=80; cc=DE; asn=44486; asn_org=SYNLINQ",
      "id": "indicator--4813eb01-f97e-4b5c-83c8-43d7afa8d630",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-03-01T22:10:13.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.88.110.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T22:10:13.000Z",
      "valid_until": "2026-04-02T22:10:12.000Z"
    },
    {
      "created": "2026-03-02T01:10:13.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=80; cc=DE; asn=44486; asn_org=SYNLINQ",
      "id": "indicator--9643b8fa-0099-4dd7-8b29-4fcd4228e265",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-03-02T01:10:13.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.88.110.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T01:10:13.000Z",
      "valid_until": "2026-04-03T01:10:12.000Z"
    },
    {
      "created": "2026-03-02T01:10:13.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--ab63a9c0-402b-42c2-a4d4-0e2d31a612e6",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-03-02T01:10:13.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T01:10:13.000Z",
      "valid_until": "2026-04-03T01:10:12.000Z"
    },
    {
      "created": "2026-03-02T14:10:02.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=80; cc=DE; asn=44486; asn_org=SYNLINQ",
      "id": "indicator--b62a469f-c141-45e4-83e6-4396426f80e5",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-03-02T14:10:02.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.88.110.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T14:10:02.000Z",
      "valid_until": "2026-04-03T14:10:01.000Z"
    },
    {
      "created": "2026-03-02T17:10:12.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=5555; cc=IN; asn=24186; asn_org=RailTel Corporation of India Ltd",
      "id": "indicator--e2f23984-6a6d-480c-9808-5d45553dc0aa",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-03-02T17:10:12.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.141.95.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T17:10:12.000Z",
      "valid_until": "2026-04-03T17:10:11.000Z"
    },
    {
      "created": "2026-03-02T20:10:12.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=16; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT F5 TMUI RCE vulnerability CVE-2020-5902 Attempt M1; ET EXPLOIT Multiple DrayTek Products Pre-authentication Remote RCE Inbound (CVE-2020-8515) M2; ports=10909; cc=DE; asn=199912; asn_org=Layer7 Networks GmbH",
      "id": "indicator--b0efaae3-de8a-4427-ac24-07517bf9df9a",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-03-02T20:10:12.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.55.240.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T20:10:12.000Z",
      "valid_until": "2026-04-03T20:10:12.000Z"
    },
    {
      "created": "2026-03-02T23:10:13.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=80; cc=PH; asn=132199; asn_org=Globe Telecom Inc.",
      "id": "indicator--3f191ee3-2afd-4aa2-9b01-51b0b2590ad8",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-03-02T23:10:13.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '222.127.53.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T23:10:13.000Z",
      "valid_until": "2026-04-03T23:10:12.000Z"
    },
    {
      "created": "2026-03-03T03:10:13.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=20; categories=Attempted Administrator Privilege Gain,Potential Corporate Privacy Violation; sigs(top)=ET EXPLOIT F5 TMUI RCE vulnerability CVE-2020-5902 Attempt M1; ET EXPLOIT Multiple DrayTek Products Pre-authentication Remote RCE Inbound (CVE-2020-8515) M2; ET INFO Cleartext WordPress Login; ports=8554; cc=BR; asn=31898; asn_org=Oracle Corporation",
      "id": "indicator--c7a3fedd-5a4c-4958-b42f-ca85be8f21f6",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-03-03T03:10:13.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '204.216.147.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T03:10:13.000Z",
      "valid_until": "2026-04-04T03:10:12.000Z"
    },
    {
      "created": "2026-03-03T07:10:02.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--57489dca-195c-47b2-8653-8c63d2512424",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-03-03T07:10:02.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T07:10:02.000Z",
      "valid_until": "2026-04-04T07:10:01.000Z"
    },
    {
      "created": "2026-03-04T04:10:12.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=9; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11910 anomalous ICMPv4 type 3,code 4 Path MTU Discovery; cc=IN; asn=17917; asn_org=Quadrant Televentures Limited",
      "id": "indicator--af560a6f-463d-4e82-9589-244e2f3f2e2c",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-03-04T04:10:12.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '112.196.109.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T04:10:12.000Z",
      "valid_until": "2026-04-05T04:10:11.000Z"
    },
    {
      "created": "2026-03-04T05:10:13.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--198cd619-fcc0-46dd-b437-00f6f118292d",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-03-04T05:10:13.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '184.105.139.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T05:10:13.000Z",
      "valid_until": "2026-04-05T05:10:12.000Z"
    },
    {
      "created": "2026-03-04T09:10:12.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound; ports=8888; cc=IR; asn=213790; asn_org=Limited Network LTD",
      "id": "indicator--f5a37c75-8cde-4507-afb7-2f2e53770137",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-03-04T09:10:12.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T09:10:12.000Z",
      "valid_until": "2026-04-05T09:10:12.000Z"
    },
    {
      "created": "2026-03-05T02:10:13.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=2; categories=Attempted Administrator Privilege Gain,Web Application Attack; sigs(top)=ET SCAN JAWS Webserver Unauthenticated Shell Command Execution; ET SCAN Mirai Variant User-Agent (Inbound); ports=80; cc=HK; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--aa20c80c-fa88-4888-bc59-a32870d420c7",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-03-05T02:10:13.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '8.210.16.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T02:10:13.000Z",
      "valid_until": "2026-04-06T02:10:12.000Z"
    },
    {
      "created": "2026-03-05T05:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--0947eb8e-72d1-41da-8a07-47349638b117",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-03-05T05:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T05:10:10.000Z",
      "valid_until": "2026-04-06T05:10:09.000Z"
    },
    {
      "created": "2026-03-06T01:10:13.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=80; cc=PK; asn=38264; asn_org=National WiMAXIMS environment",
      "id": "indicator--fb0ec68d-1cd6-4b6a-a19a-c3dccd0a9c08",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-03-06T01:10:13.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '110.37.78.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T01:10:13.000Z",
      "valid_until": "2026-04-07T01:10:12.000Z"
    },
    {
      "created": "2026-03-06T01:10:13.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=8080; cc=PK; asn=9541; asn_org=Cyber Internet Services Pvt Ltd.",
      "id": "indicator--5972004f-5a21-4c3e-ab9b-8701b4e6301e",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-03-06T01:10:13.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '124.29.214.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T01:10:13.000Z",
      "valid_until": "2026-04-07T01:10:12.000Z"
    },
    {
      "created": "2026-03-06T05:10:13.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--1607f6d8-4c37-4849-92e6-280eca3a0b2e",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-03-06T05:10:13.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T05:10:13.000Z",
      "valid_until": "2026-04-07T05:10:12.000Z"
    },
    {
      "created": "2026-03-06T08:10:15.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=7574; cc=NG; asn=329244; asn_org=Connect-Surf-and-Smile-Limited",
      "id": "indicator--bdc50673-197a-4f0f-841c-1ffb9a431cd5",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-03-06T08:10:15.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.212.40.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T08:10:15.000Z",
      "valid_until": "2026-04-07T08:10:12.000Z"
    },
    {
      "created": "2026-03-07T00:10:27.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=2; categories=Web Application Attack; sigs(top)=ET WEB_SPECIFIC_APPS Spring Framework FileSystemResource Path Traversal (CVE-2024-38816); ports=4000,4443; cc=PL; asn=201814; asn_org=MEVSPACE sp. z o.o.",
      "id": "indicator--dacc2c77-7176-4bf2-bbef-e4f8fb424478",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-03-07T00:10:27.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '193.34.212.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T00:10:27.000Z",
      "valid_until": "2026-04-08T00:10:12.000Z"
    },
    {
      "created": "2026-03-07T01:10:13.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound; ports=8080; cc=SI; asn=36680; asn_org=Netiface LLC",
      "id": "indicator--cbc2dc3f-af07-4937-b481-1db3e969a2a7",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-03-07T01:10:13.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.65.134.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T01:10:13.000Z",
      "valid_until": "2026-04-08T01:10:12.000Z"
    },
    {
      "created": "2026-03-07T02:10:01.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Web Application Attack; sigs(top)=ET WEB_SPECIFIC_APPS Spring Framework FileSystemResource Path Traversal (CVE-2024-38816); ports=3000; cc=NL; asn=206264; asn_org=Amarutu Technology Ltd",
      "id": "indicator--1c1f6392-9f4d-4cd6-b996-f0617f154ddc",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-03-07T02:10:01.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '89.42.231.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T02:10:01.000Z",
      "valid_until": "2026-04-08T02:10:00.000Z"
    },
    {
      "created": "2026-03-07T08:10:06.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--cf3bb937-4767-4f47-893d-e7069da7c960",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-03-07T08:10:06.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T08:10:06.000Z",
      "valid_until": "2026-04-08T08:10:05.000Z"
    },
    {
      "created": "2026-03-07T16:10:06.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=17; categories=Attempted Denial of Service; sigs(top)=GPL VOIP SIP INVITE message flooding; ports=5060; cc=SC; asn=49870; asn_org=Alsycon B.V.",
      "id": "indicator--fe7064a0-58f8-4d98-a235-651259f3f738",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-03-07T16:10:06.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T16:10:06.000Z",
      "valid_until": "2026-04-08T16:10:05.000Z"
    },
    {
      "created": "2026-03-08T08:10:13.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--c9469108-649b-4089-ac01-8aec7dbb7d18",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-03-08T08:10:13.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T08:10:13.000Z",
      "valid_until": "2026-04-09T08:10:12.000Z"
    },
    {
      "created": "2026-03-08T23:10:09.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=8080; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--e931d0de-9381-4bd4-b014-e7a778ae74aa",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-03-08T23:10:09.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '59.98.206.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T23:10:09.000Z",
      "valid_until": "2026-04-09T23:10:08.000Z"
    },
    {
      "created": "2026-03-09T08:10:07.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--8529e467-988c-44a7-845f-858b57d289c9",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-03-09T08:10:07.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T08:10:07.000Z",
      "valid_until": "2026-04-10T08:10:05.000Z"
    },
    {
      "created": "2026-03-09T11:10:09.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=80; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--367b9804-baf1-41e2-8766-9a3e854a0b34",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-03-09T11:10:09.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.235.114.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T11:10:09.000Z",
      "valid_until": "2026-04-10T11:10:08.000Z"
    },
    {
      "created": "2026-03-09T16:10:13.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Web Application Attack; sigs(top)=ET WEB_SPECIFIC_APPS Spring Framework FileSystemResource Path Traversal (CVE-2024-38816); ports=3000; cc=NL; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--95ad3ab5-7bfe-4e5b-bdd4-b09c7fa7cef1",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-03-09T16:10:13.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '204.76.203.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T16:10:13.000Z",
      "valid_until": "2026-04-10T16:10:12.000Z"
    },
    {
      "created": "2026-03-09T21:10:02.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Web Application Attack; sigs(top)=ET WEB_SPECIFIC_APPS Spring Framework FileSystemResource Path Traversal (CVE-2024-38816); ports=8008; cc=NL; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--9f36a1a4-3f8d-428d-aa06-02b816510394",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-03-09T21:10:02.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '204.76.203.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T21:10:02.000Z",
      "valid_until": "2026-04-10T21:10:01.000Z"
    },
    {
      "created": "2026-03-10T03:10:06.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--46c251fb-2f4c-44d7-96c4-5266f23bd3fb",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-03-10T03:10:06.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T03:10:06.000Z",
      "valid_until": "2026-04-11T03:10:05.000Z"
    },
    {
      "created": "2026-03-10T04:10:14.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=8080; cc=IN; asn=132754; asn_org=Realtel Network Services Pvt Ltd",
      "id": "indicator--ffd34c3e-2b91-4539-a374-2b122262ecbd",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-03-10T04:10:14.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '43.230.105.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T04:10:14.000Z",
      "valid_until": "2026-04-11T04:10:12.000Z"
    },
    {
      "created": "2026-03-11T06:10:02.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--089bbd09-9790-4f62-a32c-6444760cd017",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-03-11T06:10:02.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T06:10:02.000Z",
      "valid_until": "2026-04-12T06:10:01.000Z"
    },
    {
      "created": "2026-03-11T12:10:13.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=CN; asn=4538; asn_org=China Education and Research Network Center",
      "id": "indicator--e051f103-82a9-4596-875b-380594801a83",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-03-11T12:10:13.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.112.237.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T12:10:13.000Z",
      "valid_until": "2026-04-12T12:10:11.000Z"
    },
    {
      "created": "2026-03-12T08:10:14.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=7574; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--67c6373f-0ac6-4072-8b26-19900889192d",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-03-12T08:10:14.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '121.225.41.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T08:10:14.000Z",
      "valid_until": "2026-04-13T08:10:13.000Z"
    },
    {
      "created": "2026-03-12T09:10:07.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--502473cf-ad49-4840-b05d-a51cf39c3dd6",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-03-12T09:10:07.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T09:10:07.000Z",
      "valid_until": "2026-04-13T09:10:06.000Z"
    },
    {
      "created": "2026-03-14T03:10:47.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Web Application Attack; sigs(top)=ET WEB_SPECIFIC_APPS Spring Framework FileSystemResource Path Traversal (CVE-2024-38816); ports=18789; cc=NL; asn=206264; asn_org=Amarutu Technology Ltd",
      "id": "indicator--5ed391d6-686a-49ec-b900-de578c232106",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-03-14T03:10:47.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '183.81.169.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T03:10:47.000Z",
      "valid_until": "2026-04-15T03:10:11.000Z"
    },
    {
      "created": "2026-03-14T06:10:07.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=8080; cc=GE; asn=16010; asn_org=Magticom Ltd.",
      "id": "indicator--45b2a7df-3ecc-4d49-a75a-f8dc5467fdb1",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-03-14T06:10:07.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '93.177.151.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T06:10:07.000Z",
      "valid_until": "2026-04-15T06:10:05.000Z"
    },
    {
      "created": "2026-03-14T09:10:15.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--c6b4e154-80bf-4f1d-ae8d-84e6323beeb2",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-03-14T09:10:15.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T09:10:15.000Z",
      "valid_until": "2026-04-15T09:10:11.000Z"
    },
    {
      "created": "2026-03-15T09:10:14.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--dce2e845-d2b8-4254-a9ef-b8a12a069c05",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-03-15T09:10:14.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T09:10:14.000Z",
      "valid_until": "2026-04-16T09:10:12.000Z"
    },
    {
      "created": "2026-03-16T09:10:13.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--8147baa3-959e-427b-be0d-fd6ab972612a",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-03-16T09:10:13.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '184.105.247.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T09:10:13.000Z",
      "valid_until": "2026-04-17T09:10:12.000Z"
    },
    {
      "created": "2026-03-16T11:10:13.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Executable code was detected; sigs(top)=ET SHELLCODE Adenau Shellcode; ports=135; cc=FR; asn=3215; asn_org=Orange",
      "id": "indicator--0aa77709-ecaa-44e3-9d54-34444ef563e1",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-03-16T11:10:13.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '194.250.243.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T11:10:13.000Z",
      "valid_until": "2026-04-17T11:10:12.000Z"
    },
    {
      "created": "2026-03-17T07:10:14.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--6592e9e6-b693-49d3-ac17-8bbb1805adad",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-03-17T07:10:14.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '184.105.139.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T07:10:14.000Z",
      "valid_until": "2026-04-18T07:10:13.000Z"
    },
    {
      "created": "2026-03-17T19:10:13.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=7574; cc=IN; asn=24186; asn_org=RailTel Corporation of India Ltd",
      "id": "indicator--e6dd8d7a-bdf2-45fc-902b-2cfa55665cdd",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-03-17T19:10:13.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.141.38.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T19:10:13.000Z",
      "valid_until": "2026-04-18T19:10:12.000Z"
    },
    {
      "created": "2026-03-18T08:10:03.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--c976187d-1d64-4108-8a25-53ec27b62a08",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-03-18T08:10:03.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '184.105.247.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T08:10:03.000Z",
      "valid_until": "2026-04-19T08:10:01.000Z"
    },
    {
      "created": "2026-03-19T00:10:02.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=2; categories=Attempted Administrator Privilege Gain,Web Application Attack; sigs(top)=ET SCAN JAWS Webserver Unauthenticated Shell Command Execution; ET SCAN Mirai Variant User-Agent (Inbound); ports=80; cc=AR; asn=266702; asn_org=MEGALINK S.R.L.",
      "id": "indicator--a93886f8-a4d3-44d0-8db4-5fe153b32d81",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-03-19T00:10:02.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.230.66.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T00:10:02.000Z",
      "valid_until": "2026-04-20T00:10:01.000Z"
    },
    {
      "created": "2026-03-19T05:10:02.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=49152; cc=PK; asn=9541; asn_org=Cyber Internet Services Pvt Ltd.",
      "id": "indicator--4b2fad99-25ea-44be-8693-c5c3c58de197",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-03-19T05:10:02.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '144.48.134.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T05:10:02.000Z",
      "valid_until": "2026-04-20T05:10:01.000Z"
    },
    {
      "created": "2026-03-19T08:10:02.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--1425d6d8-fd61-4b5d-8ea7-69eb03df349c",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-03-19T08:10:02.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T08:10:02.000Z",
      "valid_until": "2026-04-20T08:10:01.000Z"
    },
    {
      "created": "2026-03-20T08:10:05.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--62c6db36-0b1c-436b-94bc-25c08dad14a8",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-03-20T08:10:05.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T08:10:05.000Z",
      "valid_until": "2026-04-21T08:10:01.000Z"
    },
    {
      "created": "2026-03-21T03:10:02.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--82b36727-89cb-4e0c-9280-dc6237592bb2",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-03-21T03:10:02.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T03:10:02.000Z",
      "valid_until": "2026-04-22T03:10:01.000Z"
    },
    {
      "created": "2026-03-21T10:10:02.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=2; categories=Attempted Administrator Privilege Gain,Web Application Attack; sigs(top)=ET SCAN JAWS Webserver Unauthenticated Shell Command Execution; ET SCAN Mirai Variant User-Agent (Inbound); ports=60001; cc=PK; asn=141421; asn_org=MUX BROADBAND PRIVATE LIMITED",
      "id": "indicator--b6a64034-5586-4b06-a212-7a0435157d59",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-03-21T10:10:02.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.84.57.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T10:10:02.000Z",
      "valid_until": "2026-04-22T10:10:01.000Z"
    },
    {
      "created": "2026-03-21T22:10:02.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Denial of Service; sigs(top)=GPL VOIP SIP INVITE message flooding; ports=5060; cc=FR; asn=51167; asn_org=Contabo GmbH",
      "id": "indicator--9cc76ee7-621a-48f6-8d10-b383284af91e",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-03-21T22:10:02.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.18.253.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T22:10:02.000Z",
      "valid_until": "2026-04-22T22:10:01.000Z"
    },
    {
      "created": "2026-03-22T00:10:02.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--39836e0b-f26f-4ece-a2d3-90fca6b2ff95",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-03-22T00:10:02.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '184.105.247.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T00:10:02.000Z",
      "valid_until": "2026-04-23T00:10:01.000Z"
    },
    {
      "created": "2026-03-22T02:10:13.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=80; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--c62bf109-2c67-478c-826a-4dfba5046d65",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-03-22T02:10:13.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '39.87.69.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T02:10:13.000Z",
      "valid_until": "2026-04-23T02:10:12.000Z"
    },
    {
      "created": "2026-03-22T12:10:02.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=49152; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--5a73be80-a0b2-4b22-99f0-c39bcb3213ed",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-03-22T12:10:02.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '61.3.130.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T12:10:02.000Z",
      "valid_until": "2026-04-23T12:10:01.000Z"
    },
    {
      "created": "2026-03-22T17:10:02.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=7574; cc=PK; asn=138423; asn_org=CMPak Limited",
      "id": "indicator--710f54b9-c5f6-4439-a5f7-9742751ca730",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-03-22T17:10:02.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '223.123.38.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T17:10:02.000Z",
      "valid_until": "2026-04-23T17:10:01.000Z"
    },
    {
      "created": "2026-03-23T04:10:01.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--24114656-974f-4e17-8b7c-fd30a130ee59",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-03-23T04:10:01.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T04:10:01.000Z",
      "valid_until": "2026-04-24T04:10:01.000Z"
    },
    {
      "created": "2026-03-24T04:10:02.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=8080; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--6a3056a5-48c5-460f-aacc-f21718be66cb",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-03-24T04:10:02.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.200.204.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T04:10:02.000Z",
      "valid_until": "2026-04-25T04:10:01.000Z"
    },
    {
      "created": "2026-03-24T08:10:02.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--8ab848d7-9d8c-4333-b9c6-4a0958cd2d95",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-03-24T08:10:02.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T08:10:02.000Z",
      "valid_until": "2026-04-25T08:10:01.000Z"
    },
    {
      "created": "2026-03-24T22:10:04.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=3; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11910 anomalous ICMPv4 type 3,code 4 Path MTU Discovery; cc=GB; asn=9009; asn_org=M247 Europe SRL",
      "id": "indicator--d2a9b7d8-c22a-42e8-a155-99d0ed9dab29",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-03-24T22:10:04.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '141.98.100.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T22:10:04.000Z",
      "valid_until": "2026-04-25T22:10:02.000Z"
    },
    {
      "created": "2026-03-25T10:11:00.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=5; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11910 anomalous ICMPv4 type 3,code 4 Path MTU Discovery; cc=NL; asn=49453; asn_org=Global Layer B.V.",
      "id": "indicator--000c089b-f943-4d68-a9f1-a16a60aab744",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-03-25T10:11:00.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '213.152.161.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T10:11:00.000Z",
      "valid_until": "2026-04-26T10:10:07.000Z"
    },
    {
      "created": "2026-03-25T16:10:06.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Potentially Bad Traffic; sigs(top)=GPL SCAN loopback traffic; ports=65065; cc=UA; asn=15895; asn_org=Kyivstar PJSC",
      "id": "indicator--dca05bbe-d570-421e-b9e5-8c24ef894304",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-03-25T16:10:06.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '89.162.227.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T16:10:06.000Z",
      "valid_until": "2026-04-26T16:10:04.000Z"
    },
    {
      "created": "2026-03-25T16:10:06.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=49152; cc=RU; asn=8359; asn_org=MTS PJSC",
      "id": "indicator--144c9e78-db49-4b58-bc4d-494547409220",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-03-25T16:10:06.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.243.14.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T16:10:06.000Z",
      "valid_until": "2026-04-26T16:10:04.000Z"
    },
    {
      "created": "2026-03-25T18:10:31.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=8080; cc=IN; asn=135687; asn_org=Qwistel Network Service Private Limited",
      "id": "indicator--4671104c-2e18-4bce-a9ba-3f2c033a777b",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-03-25T18:10:31.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.176.16.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T18:10:31.000Z",
      "valid_until": "2026-04-26T18:10:01.000Z"
    },
    {
      "created": "2026-03-25T20:10:05.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=2; categories=Attempted Administrator Privilege Gain,Web Application Attack; sigs(top)=ET SCAN JAWS Webserver Unauthenticated Shell Command Execution; ET SCAN Mirai Variant User-Agent (Inbound); ports=80; cc=RU; asn=8359; asn_org=MTS PJSC",
      "id": "indicator--16a07ca9-2875-4875-9f88-943487e3d8d4",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-03-25T20:10:05.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.243.10.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T20:10:05.000Z",
      "valid_until": "2026-04-26T20:10:04.000Z"
    },
    {
      "created": "2026-03-26T08:10:21.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--48ffadd0-e0fb-42fd-ba09-8b128deb1996",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-03-26T08:10:21.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T08:10:21.000Z",
      "valid_until": "2026-04-27T08:10:02.000Z"
    },
    {
      "created": "2026-03-26T22:10:01.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Potentially Bad Traffic; sigs(top)=GPL SCAN loopback traffic; ports=11276; cc=KR; asn=4766; asn_org=Korea Telecom",
      "id": "indicator--1b03367d-f312-41c2-91e5-6625ab01f098",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-03-26T22:10:01.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '119.202.140.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T22:10:01.000Z",
      "valid_until": "2026-04-27T22:10:01.000Z"
    },
    {
      "created": "2026-03-27T08:10:02.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--32e788f1-d7d8-4ca6-bc08-d5283868f023",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-03-27T08:10:02.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T08:10:02.000Z",
      "valid_until": "2026-04-28T08:10:01.000Z"
    },
    {
      "created": "2026-03-27T18:10:02.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Potentially Bad Traffic; sigs(top)=GPL SCAN loopback traffic; ports=27908; cc=RU; asn=47397; asn_org=Base Ltd.",
      "id": "indicator--43056aad-e909-4296-81c5-785d6f16b53e",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-03-27T18:10:02.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.206.18.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T18:10:02.000Z",
      "valid_until": "2026-04-28T18:10:01.000Z"
    },
    {
      "created": "2026-03-27T20:10:02.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11910 anomalous ICMPv4 type 3,code 4 Path MTU Discovery; cc=AU; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--c2d5f91d-ee4e-49b8-b119-7b4a69cd74de",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-03-27T20:10:02.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.105.186.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T20:10:02.000Z",
      "valid_until": "2026-04-28T20:10:01.000Z"
    },
    {
      "created": "2026-03-27T21:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11910 anomalous ICMPv4 type 3,code 4 Path MTU Discovery; cc=CN; asn=4538; asn_org=China Education and Research Network Center",
      "id": "indicator--81e13fb5-c612-40e8-9d0c-4c4a2d4fdfc9",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-03-27T21:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.112.237.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T21:10:10.000Z",
      "valid_until": "2026-04-28T21:10:08.000Z"
    },
    {
      "created": "2026-03-29T04:10:02.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--20fa9b81-d28e-4865-a0af-a746004c88f5",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-03-29T04:10:02.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T04:10:02.000Z",
      "valid_until": "2026-04-30T04:10:00.000Z"
    },
    {
      "created": "2026-03-29T09:10:02.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Potentially Bad Traffic; sigs(top)=GPL SCAN loopback traffic; ports=54385; cc=CA; asn=577; asn_org=Bell Canada",
      "id": "indicator--734ad28b-c2d4-4664-89ca-494ffa3ba246",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-03-29T09:10:02.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '142.117.228.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T09:10:02.000Z",
      "valid_until": "2026-04-30T09:10:01.000Z"
    },
    {
      "created": "2026-03-29T17:10:03.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=49152; cc=TW; asn=9924; asn_org=Taiwan Fixed Network, Telco and Network Service Provider.",
      "id": "indicator--db58cf0f-6f43-45ed-b967-eea852c0b3b0",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-03-29T17:10:03.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '124.11.64.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T17:10:03.000Z",
      "valid_until": "2026-04-30T17:10:01.000Z"
    },
    {
      "created": "2026-03-30T02:10:04.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=5555; cc=PK; asn=139879; asn_org=Galaxy Broadband",
      "id": "indicator--f6d89430-1184-480e-a5c3-faf5f2a4b700",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-03-30T02:10:04.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '110.38.248.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T02:10:04.000Z",
      "valid_until": "2026-05-01T02:10:03.000Z"
    },
    {
      "created": "2026-03-30T05:10:30.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=80; cc=IN; asn=24186; asn_org=RailTel Corporation of India Ltd",
      "id": "indicator--96a4d4da-f6d6-46e0-acae-60a37dedc628",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-03-30T05:10:30.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.208.105.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T05:10:30.000Z",
      "valid_until": "2026-05-01T05:10:01.000Z"
    },
    {
      "created": "2026-03-30T09:10:02.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--c2956aa6-5da3-4529-811e-ca749c4ac9de",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-03-30T09:10:02.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T09:10:02.000Z",
      "valid_until": "2026-05-01T09:10:01.000Z"
    },
    {
      "created": "2026-03-30T12:10:02.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=CN; asn=4538; asn_org=China Education and Research Network Center",
      "id": "indicator--cf9ac611-b45e-4774-8143-522675fcda19",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-03-30T12:10:02.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.112.237.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T12:10:02.000Z",
      "valid_until": "2026-05-01T12:10:01.000Z"
    }
  ],
  "spec_version": "2.1",
  "type": "bundle",
  "x_nadsec_enrichment": {
    "enriched_at": "2026-03-31T23:46:13.957072+00:00",
    "sensor": "suricata",
    "sensor_type": "network_ids",
    "month": "2026-03",
    "ip_count": 78,
    "total_alerts": 503441
  },
  "x_nadsec_ip_context": {
    "160.119.76.47": {
      "alert_count": 426668,
      "first_seen": "2026-03-02T15:16:35.587Z",
      "last_seen": "2026-03-29T19:37:23.137Z",
      "signatures": [
        "GPL VOIP SIP INVITE message flooding",
        "GPL ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited"
      ],
      "categories": [
        "Attempted Denial of Service",
        "Misc activity"
      ],
      "severities": [
        2,
        3
      ],
      "dest_ports": [
        5060
      ],
      "protocols": [
        "UDP",
        "ICMP"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 49870,
      "as_org": "Alsycon B.V.",
      "threat_score": 61.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 23.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 845634,
        "days_active_30d": 28,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T15:11:34.891000+00:00",
        "last_seen_30d": "2026-03-29T19:37:23.137000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 426668,
        "Sentrypeer": 418966
      }
    },
    "185.55.240.152": {
      "alert_count": 40888,
      "first_seen": "2026-03-02T19:56:48.771Z",
      "last_seen": "2026-03-06T03:27:37.309Z",
      "signatures": [
        "SURICATA HTTP Request unrecognized authorization method",
        "SURICATA HTTP Request excessive header repetition",
        "ET EXPLOIT F5 TMUI RCE vulnerability CVE-2020-5902 Attempt M1",
        "ET EXPLOIT Multiple DrayTek Products Pre-authentication Remote RCE Inbound (CVE-2020-8515) M2",
        "ET EXPLOIT Possible Sar2HTML plotting tool for Linux servers v3.2.1 (Inbound)",
        "ET EXPLOIT Possible SolarWinds Orion API Local File Disclosure (SWNetPerfMon.db) (CVE-2020-10148)",
        "ET EXPLOIT Possible SolarWinds Orion API Local File Disclosure (web.config) (CVE-2020-10148)",
        "ET INFO Cleartext WordPress Login",
        "SURICATA HTTP Host header invalid",
        "SURICATA HTTP Unexpected Request body",
        "ET INFO SSH session in progress on Unusual Port",
        "SURICATA STREAM spurious retransmission"
      ],
      "categories": [
        "Generic Protocol Command Decode",
        "Attempted Administrator Privilege Gain",
        "Web Application Attack",
        "Potential Corporate Privacy Violation",
        "Misc activity"
      ],
      "severities": [
        3,
        1
      ],
      "dest_ports": [
        10909,
        16058,
        43800,
        7001,
        23,
        4712,
        6200,
        6379,
        8009,
        9042
      ],
      "protocols": [
        "TCP",
        "UDP"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 199912,
      "as_org": "Layer7 Networks GmbH",
      "threat_score": 13.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 4.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 58090,
        "days_active_30d": 5,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T19:56:47+00:00",
        "last_seen_30d": "2026-03-06T03:27:37.309000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 40888,
        "Honeytrap": 17192,
        "Cowrie": 4,
        "Redishoneypot": 4,
        "Miniprint": 2
      }
    },
    "204.216.147.144": {
      "alert_count": 20580,
      "first_seen": "2026-03-03T02:38:11.863Z",
      "last_seen": "2026-03-03T04:23:11.555Z",
      "signatures": [
        "SURICATA HTTP Request unrecognized authorization method",
        "SURICATA HTTP Request excessive header repetition",
        "ET EXPLOIT F5 TMUI RCE vulnerability CVE-2020-5902 Attempt M1",
        "ET EXPLOIT Multiple DrayTek Products Pre-authentication Remote RCE Inbound (CVE-2020-8515) M2",
        "ET EXPLOIT Possible Sar2HTML plotting tool for Linux servers v3.2.1 (Inbound)",
        "ET EXPLOIT Possible SolarWinds Orion API Local File Disclosure (SWNetPerfMon.db) (CVE-2020-10148)",
        "ET EXPLOIT Possible SolarWinds Orion API Local File Disclosure (web.config) (CVE-2020-10148)",
        "ET INFO Cleartext WordPress Login",
        "SURICATA HTTP Host header invalid",
        "SURICATA HTTP Unexpected Request body",
        "ET INFO SSH session in progress on Unusual Port"
      ],
      "categories": [
        "Generic Protocol Command Decode",
        "Attempted Administrator Privilege Gain",
        "Web Application Attack",
        "Potential Corporate Privacy Violation",
        "Misc activity"
      ],
      "severities": [
        3,
        1
      ],
      "dest_ports": [
        8554,
        43800,
        7001,
        23,
        4712,
        6200,
        6379,
        8009,
        9042,
        9100
      ],
      "protocols": [
        "TCP",
        "UDP"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Vinhedo",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 29231,
        "days_active_30d": 1,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-03T02:38:10+00:00",
        "last_seen_30d": "2026-03-03T04:23:11.555000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Suricata": 20580,
        "Honeytrap": 8646,
        "Cowrie": 2,
        "Redishoneypot": 2,
        "Miniprint": 1
      }
    },
    "178.18.253.107": {
      "alert_count": 4858,
      "first_seen": "2026-03-21T21:40:14.678Z",
      "last_seen": "2026-03-22T10:22:26.205Z",
      "signatures": [
        "GPL VOIP SIP INVITE message flooding"
      ],
      "categories": [
        "Attempted Denial of Service"
      ],
      "severities": [
        2
      ],
      "dest_ports": [
        5060
      ],
      "protocols": [
        "UDP"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 30.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 7424,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T21:40:14.678000+00:00",
        "last_seen_30d": "2026-03-22T10:22:26.205000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4858,
        "Sentrypeer": 2566
      }
    },
    "89.42.231.182": {
      "alert_count": 3407,
      "first_seen": "2026-03-02T05:04:13.530Z",
      "last_seen": "2026-03-26T10:27:28.067Z",
      "signatures": [
        "ET WEB_SPECIFIC_APPS Spring Framework FileSystemResource Path Traversal (CVE-2024-38816)",
        "SURICATA Applayer Detect protocol only one direction",
        "SURICATA Applayer Mismatch protocol both directions",
        "SURICATA STREAM spurious retransmission",
        "SURICATA TLS invalid record type"
      ],
      "categories": [
        "Web Application Attack",
        "Generic Protocol Command Decode"
      ],
      "severities": [
        1,
        3
      ],
      "dest_ports": [
        8080,
        1080,
        3000,
        3080,
        3128,
        4443,
        8880,
        8881,
        9000,
        3443
      ],
      "protocols": [
        "TCP"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 206264,
      "as_org": "Amarutu Technology Ltd",
      "threat_score": 79.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 20.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 4772,
        "days_active_30d": 25,
        "ports_targeted_30d": 484,
        "honeypots_triggered_30d": 15,
        "first_seen_30d": "2026-03-02T05:04:13.530000+00:00",
        "last_seen_30d": "2026-03-26T10:27:28.067000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3407,
        "Honeytrap": 1249,
        "Cowrie": 22,
        "Mailoney": 18,
        "Miniprint": 16,
        "CitrixHoneypot": 13,
        "Honeyaml": 12,
        "Ciscoasa": 9,
        "Dionaea": 6,
        "ConPot": 5,
        "Tanner": 5,
        "Adbhoney": 4,
        "Redishoneypot": 3,
        "Ipphoney": 2,
        "ElasticPot": 1
      }
    },
    "204.76.203.215": {
      "alert_count": 1963,
      "first_seen": "2026-03-02T01:15:13.784Z",
      "last_seen": "2026-03-31T23:29:29.373Z",
      "signatures": [
        "SURICATA Applayer Mismatch protocol both directions",
        "ET WEB_SPECIFIC_APPS Spring Framework FileSystemResource Path Traversal (CVE-2024-38816)",
        "SURICATA Applayer Detect protocol only one direction",
        "SURICATA TLS invalid record type",
        "SURICATA Applayer Wrong direction first Data",
        "SURICATA STREAM spurious retransmission"
      ],
      "categories": [
        "Generic Protocol Command Decode",
        "Web Application Attack"
      ],
      "severities": [
        3,
        1
      ],
      "dest_ports": [
        8080,
        3000,
        1521,
        1556,
        1090,
        8000,
        1580,
        3443,
        8008,
        3128
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 100,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 2740,
        "days_active_30d": 30,
        "ports_targeted_30d": 311,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-03-02T01:15:13.784000+00:00",
        "last_seen_30d": "2026-03-31T23:29:29.373000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1963,
        "Honeytrap": 749,
        "Honeyaml": 11,
        "Dionaea": 7,
        "Ciscoasa": 4,
        "CitrixHoneypot": 2,
        "ElasticPot": 2,
        "Tanner": 2
      }
    },
    "183.81.169.235": {
      "alert_count": 1750,
      "first_seen": "2026-03-06T23:35:51.605Z",
      "last_seen": "2026-03-31T23:38:26.817Z",
      "signatures": [
        "SURICATA Applayer Detect protocol only one direction",
        "SURICATA Applayer Wrong direction first Data",
        "SURICATA Applayer Mismatch protocol both directions",
        "ET WEB_SPECIFIC_APPS Spring Framework FileSystemResource Path Traversal (CVE-2024-38816)",
        "SURICATA STREAM spurious retransmission"
      ],
      "categories": [
        "Generic Protocol Command Decode",
        "Web Application Attack"
      ],
      "severities": [
        3,
        1
      ],
      "dest_ports": [
        18789,
        18791,
        3000,
        443,
        6443,
        4443,
        8443,
        3001,
        4444,
        8009
      ],
      "protocols": [
        "TCP"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 206264,
      "as_org": "Amarutu Technology Ltd",
      "threat_score": 96.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 2324,
        "days_active_30d": 26,
        "ports_targeted_30d": 430,
        "honeypots_triggered_30d": 12,
        "first_seen_30d": "2026-03-06T23:35:51.329000+00:00",
        "last_seen_30d": "2026-03-31T23:38:26.817000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1750,
        "Honeytrap": 531,
        "Mailoney": 12,
        "Cowrie": 8,
        "Honeyaml": 7,
        "Dionaea": 6,
        "ConPot": 3,
        "Ciscoasa": 2,
        "CitrixHoneypot": 2,
        "ElasticPot": 1,
        "Ipphoney": 1,
        "Tanner": 1
      }
    },
    "204.76.203.73": {
      "alert_count": 1406,
      "first_seen": "2026-03-02T00:11:47.757Z",
      "last_seen": "2026-03-20T04:35:19.048Z",
      "signatures": [
        "SURICATA Applayer Detect protocol only one direction",
        "SURICATA TLS invalid record type",
        "ET WEB_SPECIFIC_APPS Spring Framework FileSystemResource Path Traversal (CVE-2024-38816)",
        "SURICATA STREAM spurious retransmission",
        "SURICATA Applayer Mismatch protocol both directions",
        "SURICATA Applayer Wrong direction first Data"
      ],
      "categories": [
        "Generic Protocol Command Decode",
        "Web Application Attack"
      ],
      "severities": [
        3,
        1
      ],
      "dest_ports": [
        8080,
        81,
        8008,
        8000,
        8443,
        80,
        8081,
        8181,
        8888,
        4443
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 57.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 15.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 1948,
        "days_active_30d": 19,
        "ports_targeted_30d": 279,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-03-02T00:11:47.757000+00:00",
        "last_seen_30d": "2026-03-20T04:35:19.048000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1406,
        "Honeytrap": 501,
        "Dionaea": 25,
        "Ciscoasa": 6,
        "CitrixHoneypot": 4,
        "Tanner": 4,
        "ElasticPot": 1,
        "Ipphoney": 1
      }
    },
    "193.34.212.9": {
      "alert_count": 840,
      "first_seen": "2026-03-04T08:17:36.369Z",
      "last_seen": "2026-03-10T09:54:11.355Z",
      "signatures": [
        "ET WEB_SPECIFIC_APPS Spring Framework FileSystemResource Path Traversal (CVE-2024-38816)",
        "SURICATA Applayer Mismatch protocol both directions",
        "SURICATA Applayer Detect protocol only one direction",
        "SURICATA TLS invalid record type"
      ],
      "categories": [
        "Web Application Attack",
        "Generic Protocol Command Decode"
      ],
      "severities": [
        1,
        3
      ],
      "dest_ports": [
        4000,
        80,
        4443,
        8080,
        5443,
        7080,
        7443,
        8002,
        8005,
        3000
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": null,
      "asn": 201814,
      "as_org": "MEVSPACE sp. z o.o.",
      "threat_score": 24.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 5.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 1223,
        "days_active_30d": 7,
        "ports_targeted_30d": 52,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-04T08:17:36.369000+00:00",
        "last_seen_30d": "2026-03-10T09:54:11.355000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Suricata": 840,
        "Honeytrap": 360,
        "CitrixHoneypot": 8,
        "Tanner": 7,
        "Ciscoasa": 4,
        "Honeyaml": 4
      }
    },
    "176.65.134.22": {
      "alert_count": 92,
      "first_seen": "2026-03-02T11:17:26.239Z",
      "last_seen": "2026-03-19T17:05:23.114Z",
      "signatures": [
        "ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound",
        "ET INFO SSH session in progress on Expected Port"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Misc activity"
      ],
      "severities": [
        1,
        3
      ],
      "dest_ports": [
        8080,
        23,
        22,
        80,
        8081,
        25565,
        3000
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Slovenia",
      "country_code": "SI",
      "city": null,
      "asn": 36680,
      "as_org": "Netiface LLC",
      "threat_score": 42.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.7,
        "persistence": 15.0,
        "diversity": 14,
        "spread": 20,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 148,
        "days_active_30d": 18,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T11:17:26.239000+00:00",
        "last_seen_30d": "2026-03-19T17:05:23.114000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Suricata": 92,
        "Cowrie": 52,
        "Honeytrap": 3,
        "Tanner": 1
      }
    },
    "185.93.89.75": {
      "alert_count": 76,
      "first_seen": "2026-03-02T01:13:06.509Z",
      "last_seen": "2026-03-08T09:18:57.263Z",
      "signatures": [
        "ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        9090,
        8888
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 9.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.2,
        "persistence": 5.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 105,
        "days_active_30d": 7,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T01:13:06+00:00",
        "last_seen_30d": "2026-03-08T09:18:57.263000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Suricata": 76,
        "Honeytrap": 29
      }
    },
    "202.112.237.233": {
      "alert_count": 48,
      "first_seen": "2026-03-03T12:37:06.397Z",
      "last_seen": "2026-03-26T01:49:04.706Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        80
      ],
      "protocols": [
        "TCP",
        "IP-in-IP"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4538,
      "as_org": "China Education and Research Network Center",
      "threat_score": 36.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.8,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 48,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-03-03T12:37:06.397000+00:00",
        "last_seen_30d": "2026-03-26T01:49:04.706000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 48
      }
    },
    "223.123.38.34": {
      "alert_count": 40,
      "first_seen": "2026-03-11T05:42:23.028Z",
      "last_seen": "2026-03-31T03:17:23.520Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        23,
        7574
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 138423,
      "as_org": "CMPak Limited",
      "threat_score": 56.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.4,
        "persistence": 17.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 109,
        "days_active_30d": 21,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-11T05:41:14.042000+00:00",
        "last_seen_30d": "2026-03-31T03:17:23.520000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 68,
        "Suricata": 40,
        "Honeytrap": 1
      }
    },
    "213.152.161.50": {
      "alert_count": 34,
      "first_seen": "2026-03-24T10:56:18.450Z",
      "last_seen": "2026-03-25T09:42:09.557Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11910 anomalous ICMPv4 type 3,code 4 Path MTU Discovery"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        21,
        22,
        161,
        80,
        445,
        23,
        111,
        139,
        443,
        123
      ],
      "protocols": [
        "TCP",
        "ICMP",
        "UDP"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Haarlem",
      "asn": 49453,
      "as_org": "Global Layer B.V.",
      "threat_score": 50.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.8,
        "persistence": 1.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 48,
        "days_active_30d": 2,
        "ports_targeted_30d": 12,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-24T10:56:18.450000+00:00",
        "last_seen_30d": "2026-03-25T09:42:09.557000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 34,
        "Cowrie": 8,
        "ConPot": 2,
        "Dionaea": 2,
        "Honeytrap": 1,
        "Tanner": 1
      }
    },
    "65.49.1.189": {
      "alert_count": 32,
      "first_seen": "2026-03-02T13:25:13.054Z",
      "last_seen": "2026-03-29T04:02:51.089Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        8080,
        443,
        24156,
        4848,
        102,
        2000,
        3000,
        5432,
        5443,
        6080
      ],
      "protocols": [
        "TCP",
        "IP-in-IP",
        "UDP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 69.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.8,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 28,
        "ports_targeted_30d": 16,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T13:25:13.054000+00:00",
        "last_seen_30d": "2026-03-29T04:02:51.089000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 32,
        "Honeytrap": 5,
        "H0neytr4p": 1
      }
    },
    "94.243.14.174": {
      "alert_count": 32,
      "first_seen": "2026-03-24T17:56:13.937Z",
      "last_seen": "2026-03-25T16:01:35.179Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)",
        "SURICATA HTTP Unexpected Request body"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Generic Protocol Command Decode"
      ],
      "severities": [
        1,
        3
      ],
      "dest_ports": [
        23,
        49152
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Tyumen",
      "asn": 8359,
      "as_org": "MTS PJSC",
      "threat_score": 31.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.2,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 83,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-24T17:55:13.642000+00:00",
        "last_seen_30d": "2026-03-25T16:01:35.179000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 32,
        "Honeytrap": 1
      }
    },
    "64.62.156.213": {
      "alert_count": 31,
      "first_seen": "2026-03-02T02:40:00.815Z",
      "last_seen": "2026-03-31T03:37:42.811Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        443,
        7047,
        83,
        90,
        212,
        427,
        500,
        502,
        541,
        631
      ],
      "protocols": [
        "TCP",
        "IP-in-IP",
        "UDP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 70.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 30,
        "ports_targeted_30d": 22,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T02:40:00.815000+00:00",
        "last_seen_30d": "2026-03-31T03:37:42.811000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 31,
        "Honeytrap": 3
      }
    },
    "64.62.197.53": {
      "alert_count": 30,
      "first_seen": "2026-03-03T11:26:20.293Z",
      "last_seen": "2026-03-31T01:25:36.128Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        443,
        9060,
        23856,
        24056,
        88,
        135,
        1311,
        2123,
        4899,
        5678
      ],
      "protocols": [
        "TCP",
        "IP-in-IP",
        "UDP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 70.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.8,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 29,
        "ports_targeted_30d": 24,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T11:25:09+00:00",
        "last_seen_30d": "2026-03-31T01:25:36.128000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 30,
        "Honeytrap": 8
      }
    },
    "45.88.110.44": {
      "alert_count": 29,
      "first_seen": "2026-03-02T00:53:16.392Z",
      "last_seen": "2026-03-02T13:07:02.227Z",
      "signatures": [
        "SURICATA HTTP missing Host header",
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Generic Protocol Command Decode",
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        3,
        1
      ],
      "dest_ports": [
        80
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 44486,
      "as_org": "SYNLINQ",
      "threat_score": 2.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-03-02T00:53:16.392000+00:00",
        "last_seen_30d": "2026-03-02T13:07:02.227000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Suricata": 29
      }
    },
    "64.62.156.129": {
      "alert_count": 29,
      "first_seen": "2026-03-02T03:26:20.253Z",
      "last_seen": "2026-03-31T08:55:35.089Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        80,
        4444,
        8001,
        9200,
        443,
        801,
        1801,
        4646,
        5002,
        5080
      ],
      "protocols": [
        "TCP",
        "IP-in-IP",
        "UDP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 80.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 15.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 36,
        "days_active_30d": 30,
        "ports_targeted_30d": 23,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T03:26:20.107000+00:00",
        "last_seen_30d": "2026-03-31T08:55:35.089000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 29,
        "Honeytrap": 5,
        "ElasticPot": 1,
        "Tanner": 1
      }
    },
    "65.49.1.127": {
      "alert_count": 26,
      "first_seen": "2026-03-02T03:13:14.471Z",
      "last_seen": "2026-03-31T06:01:31.956Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free",
        "ET INFO SSH session in progress on Unusual Port"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Misc activity"
      ],
      "severities": [
        1,
        3
      ],
      "dest_ports": [
        22522,
        89,
        427,
        1234,
        1723,
        2087,
        5080,
        5805,
        5905,
        6002
      ],
      "protocols": [
        "TCP",
        "IP-in-IP",
        "UDP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 69.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 30,
        "ports_targeted_30d": 22,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T03:13:14.471000+00:00",
        "last_seen_30d": "2026-03-31T06:01:31.956000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 26,
        "Honeytrap": 4
      }
    },
    "64.62.156.151": {
      "alert_count": 25,
      "first_seen": "2026-03-07T06:15:57.887Z",
      "last_seen": "2026-03-31T08:25:20.608Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free",
        "SURICATA STREAM Packet with broken ack"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Generic Protocol Command Decode"
      ],
      "severities": [
        1,
        3
      ],
      "dest_ports": [
        80,
        3790,
        25,
        82,
        90,
        873,
        3001,
        3333,
        4117,
        4443
      ],
      "protocols": [
        "TCP",
        "IP-in-IP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 70.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.8,
        "persistence": 20.8,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 25,
        "ports_targeted_30d": 19,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-07T06:15:57.887000+00:00",
        "last_seen_30d": "2026-03-31T08:25:20.608000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 25,
        "Honeytrap": 4,
        "Tanner": 1
      }
    },
    "64.62.156.79": {
      "alert_count": 25,
      "first_seen": "2026-03-04T05:39:07.564Z",
      "last_seen": "2026-03-31T03:36:37.143Z",
      "signatures": [
        "ET INFO SSH session in progress on Unusual Port",
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"
      ],
      "categories": [
        "Misc activity",
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        3,
        1
      ],
      "dest_ports": [
        22122,
        50000,
        9001,
        9200,
        88,
        1883,
        2096,
        3000,
        4433,
        4848
      ],
      "protocols": [
        "TCP",
        "IP-in-IP",
        "UDP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 73.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.1,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 32,
        "days_active_30d": 28,
        "ports_targeted_30d": 17,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-04T05:39:07.564000+00:00",
        "last_seen_30d": "2026-03-31T03:36:37.143000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 25,
        "Honeytrap": 6,
        "ElasticPot": 1
      }
    },
    "64.62.197.200": {
      "alert_count": 25,
      "first_seen": "2026-03-02T00:48:56.715Z",
      "last_seen": "2026-03-31T08:57:56.492Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        443,
        4080,
        53,
        84,
        789,
        2600,
        3333,
        4081,
        4369,
        5905
      ],
      "protocols": [
        "TCP",
        "IP-in-IP",
        "UDP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 69.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 30,
        "ports_targeted_30d": 21,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T00:48:56.715000+00:00",
        "last_seen_30d": "2026-03-31T08:57:56.492000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 25,
        "Honeytrap": 5
      }
    },
    "65.49.1.139": {
      "alert_count": 25,
      "first_seen": "2026-03-02T09:00:21.038Z",
      "last_seen": "2026-03-30T14:35:05.980Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free",
        "ET INFO SSH session in progress on Unusual Port"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Misc activity"
      ],
      "severities": [
        1,
        3
      ],
      "dest_ports": [
        53282,
        9200,
        24056,
        47808,
        830,
        3001,
        4081,
        4848,
        5001,
        5901
      ],
      "protocols": [
        "TCP",
        "UDP",
        "IP-in-IP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 71.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.1,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 32,
        "days_active_30d": 29,
        "ports_targeted_30d": 18,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T09:00:21.038000+00:00",
        "last_seen_30d": "2026-03-30T14:35:05.980000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 25,
        "Honeytrap": 6,
        "ElasticPot": 1
      }
    },
    "112.196.109.146": {
      "alert_count": 21,
      "first_seen": "2026-03-04T03:37:01.268Z",
      "last_seen": "2026-03-29T02:40:53.421Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11910 anomalous ICMPv4 type 3,code 4 Path MTU Discovery"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [],
      "protocols": [
        "ICMP"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Chandigarh",
      "asn": 17917,
      "as_org": "Quadrant Televentures Limited",
      "threat_score": 37.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.2,
        "persistence": 21.7,
        "diversity": 0,
        "spread": 5,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 26,
        "ports_targeted_30d": 0,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-03-04T03:37:01.268000+00:00",
        "last_seen_30d": "2026-03-29T02:40:53.421000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 21
      }
    },
    "64.62.156.168": {
      "alert_count": 21,
      "first_seen": "2026-03-02T00:10:35.880Z",
      "last_seen": "2026-03-30T01:57:48.722Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        443,
        65422,
        102,
        445,
        830,
        4840,
        5555,
        10001,
        24156
      ],
      "protocols": [
        "TCP",
        "IP-in-IP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 63.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 13.4,
        "persistence": 24.2,
        "diversity": 18,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 29,
        "ports_targeted_30d": 9,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T00:10:35.880000+00:00",
        "last_seen_30d": "2026-03-30T01:57:48.722000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 21,
        "Honeytrap": 1
      }
    },
    "65.49.1.169": {
      "alert_count": 21,
      "first_seen": "2026-03-03T09:39:10.234Z",
      "last_seen": "2026-03-30T07:04:20.125Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        8080,
        6081,
        2002,
        5001,
        5443,
        5678,
        5802,
        5803,
        8030,
        9999
      ],
      "protocols": [
        "TCP",
        "IP-in-IP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 65.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.0,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 28,
        "ports_targeted_30d": 16,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T09:39:10.234000+00:00",
        "last_seen_30d": "2026-03-30T07:04:20.125000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 21,
        "Honeytrap": 4
      }
    },
    "1.34.85.243": {
      "alert_count": 20,
      "first_seen": "2026-03-09T23:13:02.344Z",
      "last_seen": "2026-03-30T11:08:58.394Z",
      "signatures": [
        "ET EXPLOIT Possible VXWORKS Urgent11 RCE Attempt - Illegal Urgent Flag",
        "ET EXPLOIT Possible VXWORKS Urgent11 RCE Attempt - Urgent Flag",
        "SURICATA STREAM RST recv but no session"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Generic Protocol Command Decode"
      ],
      "severities": [
        1,
        3
      ],
      "dest_ports": [
        190,
        9030,
        36020,
        44603,
        55175
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "New Taipei City",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 44.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.0,
        "persistence": 18.3,
        "diversity": 10,
        "spread": 5,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 22,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-03-09T23:13:02.344000+00:00",
        "last_seen_30d": "2026-03-30T11:08:58.394000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 20
      }
    },
    "65.49.1.174": {
      "alert_count": 20,
      "first_seen": "2026-03-02T11:34:49.314Z",
      "last_seen": "2026-03-31T12:10:50.635Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free",
        "SURICATA STREAM Packet with broken ack"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Generic Protocol Command Decode"
      ],
      "severities": [
        1,
        3
      ],
      "dest_ports": [
        1337,
        80,
        4848,
        995,
        2455,
        6000,
        7047,
        8530,
        9642,
        11453
      ],
      "protocols": [
        "TCP",
        "IP-in-IP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 69.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 30,
        "ports_targeted_30d": 14,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T11:34:49.314000+00:00",
        "last_seen_30d": "2026-03-31T12:10:50.635000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 20,
        "Honeytrap": 5
      }
    },
    "65.49.1.203": {
      "alert_count": 20,
      "first_seen": "2026-03-06T13:16:16.743Z",
      "last_seen": "2026-03-30T13:53:54.083Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        3000,
        5080,
        83,
        87,
        1337,
        3001,
        5007,
        5904,
        7047,
        9999
      ],
      "protocols": [
        "TCP",
        "IP-in-IP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 67.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 13.8,
        "persistence": 20.8,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 25,
        "ports_targeted_30d": 14,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-06T13:16:16.743000+00:00",
        "last_seen_30d": "2026-03-30T13:53:54.083000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 20,
        "Honeyaml": 2,
        "Honeytrap": 2
      }
    },
    "184.105.139.119": {
      "alert_count": 19,
      "first_seen": "2026-03-03T02:18:51.548Z",
      "last_seen": "2026-03-30T01:34:12.376Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        8443,
        443,
        449,
        2096,
        5081,
        5094,
        5672,
        6025,
        9002,
        10001
      ],
      "protocols": [
        "TCP",
        "IP-in-IP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 69.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 13.2,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 28,
        "ports_targeted_30d": 13,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T02:18:51.548000+00:00",
        "last_seen_30d": "2026-03-30T01:34:12.376000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 19,
        "Ciscoasa": 1,
        "Honeytrap": 1
      }
    },
    "64.62.197.206": {
      "alert_count": 19,
      "first_seen": "2026-03-04T02:11:42.637Z",
      "last_seen": "2026-03-29T05:35:50.626Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        443,
        2600,
        22,
        86,
        4118,
        5007,
        5985,
        6001,
        8001,
        8015
      ],
      "protocols": [
        "TCP",
        "IP-in-IP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 60.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 13.6,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 26,
        "ports_targeted_30d": 13,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T02:10:32+00:00",
        "last_seen_30d": "2026-03-29T05:35:50.626000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 19,
        "Honeytrap": 4
      }
    },
    "64.62.197.162": {
      "alert_count": 18,
      "first_seen": "2026-03-02T03:21:27.150Z",
      "last_seen": "2026-03-30T14:30:17.298Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free",
        "ET INFO SSH session in progress on Expected Port"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Misc activity"
      ],
      "severities": [
        1,
        3
      ],
      "dest_ports": [
        22,
        80,
        84,
        110,
        177,
        800,
        1311,
        1801,
        1962,
        2096
      ],
      "protocols": [
        "TCP",
        "IP-in-IP",
        "UDP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 70.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.0,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 29,
        "ports_targeted_30d": 14,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T03:20:20+00:00",
        "last_seen_30d": "2026-03-30T14:30:17.298000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 18,
        "Cowrie": 4,
        "Honeytrap": 3
      }
    },
    "64.62.197.84": {
      "alert_count": 18,
      "first_seen": "2026-03-02T06:20:09.079Z",
      "last_seen": "2026-03-27T15:11:43.927Z",
      "signatures": [],
      "categories": [],
      "severities": [],
      "dest_ports": [
        389,
        82,
        86,
        110,
        3283,
        4434,
        5002,
        5007,
        5080,
        5081
      ],
      "protocols": [
        "TCP",
        "UDP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 56.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.2,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 26,
        "ports_targeted_30d": 17,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T06:19:03+00:00",
        "last_seen_30d": "2026-03-27T15:11:43.927000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 18,
        "Honeytrap": 3
      }
    },
    "65.49.1.171": {
      "alert_count": 18,
      "first_seen": "2026-03-09T03:26:13.496Z",
      "last_seen": "2026-03-28T11:38:41.903Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        1311,
        6516,
        81,
        789,
        1234,
        5001,
        7900,
        8081,
        8883,
        9200
      ],
      "protocols": [
        "TCP",
        "IP-in-IP",
        "UDP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 54.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.4,
        "persistence": 16.7,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 20,
        "ports_targeted_30d": 14,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T03:26:13.496000+00:00",
        "last_seen_30d": "2026-03-28T11:38:41.903000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 18,
        "Honeytrap": 4
      }
    },
    "64.62.197.239": {
      "alert_count": 17,
      "first_seen": "2026-03-02T04:07:44.423Z",
      "last_seen": "2026-03-31T01:50:25.250Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        443,
        22,
        1003,
        1337,
        3478,
        3790,
        4899,
        5060,
        5903,
        6002
      ],
      "protocols": [
        "TCP",
        "UDP",
        "IP-in-IP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 67.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 12.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 30,
        "ports_targeted_30d": 14,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T04:06:37+00:00",
        "last_seen_30d": "2026-03-31T01:50:25.250000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 17,
        "Honeytrap": 1
      }
    },
    "64.62.197.69": {
      "alert_count": 16,
      "first_seen": "2026-03-06T11:43:41.747Z",
      "last_seen": "2026-03-31T09:51:45.674Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        21,
        102,
        443,
        548,
        4080,
        4443,
        6025,
        8081,
        9200,
        11211
      ],
      "protocols": [
        "TCP",
        "IP-in-IP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 64.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 12.6,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 26,
        "ports_targeted_30d": 14,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T11:43:41.747000+00:00",
        "last_seen_30d": "2026-03-31T09:51:45.674000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 16,
        "Honeytrap": 2
      }
    },
    "64.62.197.91": {
      "alert_count": 15,
      "first_seen": "2026-03-04T03:29:15.686Z",
      "last_seen": "2026-03-31T09:42:13.243Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        161,
        1080,
        1337,
        2323,
        3389,
        3790,
        4840,
        8888,
        9443,
        9593
      ],
      "protocols": [
        "TCP",
        "IP-in-IP",
        "UDP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 65.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 12.6,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 28,
        "ports_targeted_30d": 12,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T03:29:15.686000+00:00",
        "last_seen_30d": "2026-03-31T09:42:13.243000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 15,
        "Honeytrap": 3
      }
    },
    "184.105.247.224": {
      "alert_count": 14,
      "first_seen": "2026-03-10T11:30:24.377Z",
      "last_seen": "2026-03-24T01:47:55.302Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        8443,
        13443,
        89,
        1801,
        5900,
        6025,
        8006,
        49666
      ],
      "protocols": [
        "TCP",
        "IP-in-IP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 42.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.3,
        "persistence": 12.5,
        "diversity": 16,
        "spread": 15,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 15,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-10T11:29:15+00:00",
        "last_seen_30d": "2026-03-24T01:47:55.302000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 14,
        "Honeytrap": 2,
        "Ciscoasa": 1
      }
    },
    "216.218.206.102": {
      "alert_count": 14,
      "first_seen": "2026-03-02T13:47:27.861Z",
      "last_seen": "2026-03-26T02:18:51.409Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free",
        "ET INFO SSH session in progress on Unusual Port"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Misc activity"
      ],
      "severities": [
        1,
        3
      ],
      "dest_ports": [
        53282,
        443,
        8443,
        4848,
        12443,
        18789,
        50075
      ],
      "protocols": [
        "TCP",
        "IP-in-IP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Cazadero",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 51.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.0,
        "persistence": 20.8,
        "diversity": 14,
        "spread": 15,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 25,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T13:47:27.861000+00:00",
        "last_seen_30d": "2026-03-26T02:18:51.409000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 14,
        "Ciscoasa": 1,
        "Honeytrap": 1
      }
    },
    "184.105.139.99": {
      "alert_count": 13,
      "first_seen": "2026-03-03T07:50:46.002Z",
      "last_seen": "2026-03-27T05:11:53.363Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        8080,
        443,
        8443,
        87,
        143,
        500,
        7547
      ],
      "protocols": [
        "TCP",
        "IP-in-IP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 44.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 11.1,
        "persistence": 20.8,
        "diversity": 14,
        "spread": 5,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 25,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-03-03T07:50:46.002000+00:00",
        "last_seen_30d": "2026-03-27T05:11:53.363000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 13
      }
    },
    "141.98.100.151": {
      "alert_count": 12,
      "first_seen": "2026-03-24T21:26:38.646Z",
      "last_seen": "2026-03-24T21:37:59.396Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11910 anomalous ICMPv4 type 3,code 4 Path MTU Discovery"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        80,
        445,
        23,
        111,
        443,
        8080,
        8081
      ],
      "protocols": [
        "TCP",
        "ICMP"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Poplar",
      "asn": 9009,
      "as_org": "M247 Europe SRL",
      "threat_score": 40.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.3,
        "persistence": 0.8,
        "diversity": 14,
        "spread": 25,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 1,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-24T21:24:32.557000+00:00",
        "last_seen_30d": "2026-03-24T21:37:59.396000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 12,
        "Cowrie": 2,
        "Dionaea": 1,
        "Honeytrap": 1,
        "Tanner": 1
      }
    },
    "184.105.247.220": {
      "alert_count": 12,
      "first_seen": "2026-03-04T01:28:42.734Z",
      "last_seen": "2026-03-23T07:36:30.750Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        443,
        22,
        3000,
        8001,
        17689,
        31337,
        49665
      ],
      "protocols": [
        "TCP",
        "IP-in-IP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 34.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.8,
        "persistence": 16.7,
        "diversity": 14,
        "spread": 5,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 20,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-03-04T01:28:42.734000+00:00",
        "last_seen_30d": "2026-03-23T07:36:30.750000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 12
      }
    },
    "194.250.243.43": {
      "alert_count": 9,
      "first_seen": "2026-03-16T10:16:43.639Z",
      "last_seen": "2026-03-16T11:31:08.251Z",
      "signatures": [
        "SURICATA STREAM Packet with broken ack",
        "ET SHELLCODE Adenau Shellcode"
      ],
      "categories": [
        "Generic Protocol Command Decode",
        "Executable code was detected"
      ],
      "severities": [
        3,
        1
      ],
      "dest_ports": [
        135,
        4444
      ],
      "protocols": [
        "TCP"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Paris",
      "asn": 3215,
      "as_org": "Orange",
      "threat_score": 15.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-16T10:16:38.889000+00:00",
        "last_seen_30d": "2026-03-16T11:31:08.251000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Dionaea": 2,
        "Honeytrap": 2
      }
    },
    "102.212.40.100": {
      "alert_count": 8,
      "first_seen": "2026-03-02T15:54:06.561Z",
      "last_seen": "2026-03-06T07:18:41.226Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        80,
        7574
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Nigeria",
      "country_code": "NG",
      "city": "Uyo",
      "asn": 329244,
      "as_org": "Connect-Surf-and-Smile-Limited",
      "threat_score": 5.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 4.2,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 5,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T15:54:06.151000+00:00",
        "last_seen_30d": "2026-03-06T07:18:41.226000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Honeytrap": 1,
        "Tanner": 1
      }
    },
    "45.88.110.95": {
      "alert_count": 7,
      "first_seen": "2026-03-02T13:27:55.609Z",
      "last_seen": "2026-03-02T13:28:58.016Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)",
        "SURICATA HTTP missing Host header"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Generic Protocol Command Decode"
      ],
      "severities": [
        1,
        3
      ],
      "dest_ports": [
        80
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 44486,
      "as_org": "SYNLINQ",
      "threat_score": 1.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-03-02T13:27:55.609000+00:00",
        "last_seen_30d": "2026-03-02T13:28:58.016000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7
      }
    },
    "74.82.47.55": {
      "alert_count": 7,
      "first_seen": "2026-03-13T07:58:28.683Z",
      "last_seen": "2026-03-31T04:37:10.255Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        11,
        2001,
        8010,
        9000,
        12654
      ],
      "protocols": [
        "TCP",
        "IP-in-IP",
        "UDP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Gunnison",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 44.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 9.0,
        "persistence": 15.8,
        "diversity": 10,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 19,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T07:57:18+00:00",
        "last_seen_30d": "2026-03-31T04:37:10.255000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Honeytrap": 1
      }
    },
    "124.11.64.42": {
      "alert_count": 6,
      "first_seen": "2026-03-29T17:09:59.425Z",
      "last_seen": "2026-03-29T17:09:59.428Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)",
        "SURICATA HTTP Unexpected Request body"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Generic Protocol Command Decode"
      ],
      "severities": [
        1,
        3
      ],
      "dest_ports": [
        49152
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": null,
      "asn": 9924,
      "as_org": "Taiwan Fixed Network, Telco and Network Service Provider.",
      "threat_score": 19.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T17:08:49+00:00",
        "last_seen_30d": "2026-03-29T17:09:59.428000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Honeytrap": 1
      }
    },
    "184.105.247.210": {
      "alert_count": 6,
      "first_seen": "2026-03-10T11:09:53.093Z",
      "last_seen": "2026-03-30T05:55:40.116Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        7,
        7001,
        8880,
        44818
      ],
      "protocols": [
        "TCP",
        "IP-in-IP",
        "UDP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Shawnee",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 37.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.8,
        "persistence": 17.5,
        "diversity": 8,
        "spread": 5,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 21,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-03-10T11:09:53.093000+00:00",
        "last_seen_30d": "2026-03-30T05:55:40.116000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6
      }
    },
    "61.3.130.161": {
      "alert_count": 6,
      "first_seen": "2026-03-22T11:28:23.763Z",
      "last_seen": "2026-03-22T11:28:23.764Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)",
        "SURICATA HTTP Unexpected Request body"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Generic Protocol Command Decode"
      ],
      "severities": [
        1,
        3
      ],
      "dest_ports": [
        49152
      ],
      "protocols": [
        "TCP"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Alappuzha",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 14.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T11:27:14+00:00",
        "last_seen_30d": "2026-03-22T11:28:23.764000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Honeytrap": 1
      }
    },
    "8.210.16.217": {
      "alert_count": 6,
      "first_seen": "2026-03-05T01:21:04.385Z",
      "last_seen": "2026-03-05T01:22:12.727Z",
      "signatures": [
        "ET SCAN JAWS Webserver Unauthenticated Shell Command Execution",
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Web Application Attack"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        80
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 2.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-03-05T01:21:04.385000+00:00",
        "last_seen_30d": "2026-03-05T01:22:12.727000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6
      }
    },
    "103.176.16.7": {
      "alert_count": 5,
      "first_seen": "2026-03-25T17:18:53.249Z",
      "last_seen": "2026-03-25T17:19:57.247Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        8080
      ],
      "protocols": [
        "TCP"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 135687,
      "as_org": "Qwistel Network Service Private Limited",
      "threat_score": 11.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-03-25T17:18:53.249000+00:00",
        "last_seen_30d": "2026-03-25T17:19:57.247000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5
      }
    },
    "117.200.204.54": {
      "alert_count": 5,
      "first_seen": "2026-03-24T03:19:26.870Z",
      "last_seen": "2026-03-24T03:20:34.024Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        8080
      ],
      "protocols": [
        "TCP"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Visakhapatnam",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 11.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-03-24T03:19:26.870000+00:00",
        "last_seen_30d": "2026-03-24T03:20:34.024000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5
      }
    },
    "124.29.214.201": {
      "alert_count": 5,
      "first_seen": "2026-03-06T00:14:12.689Z",
      "last_seen": "2026-03-06T00:15:18.174Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        8080
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 2.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-03-06T00:14:12.689000+00:00",
        "last_seen_30d": "2026-03-06T00:15:18.174000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5
      }
    },
    "144.48.134.244": {
      "alert_count": 5,
      "first_seen": "2026-03-19T04:17:20.711Z",
      "last_seen": "2026-03-19T04:18:31.697Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)",
        "SURICATA HTTP Unexpected Request body"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Generic Protocol Command Decode"
      ],
      "severities": [
        1,
        3
      ],
      "dest_ports": [
        49152
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Multan",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T04:17:19+00:00",
        "last_seen_30d": "2026-03-19T04:18:31.697000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Honeytrap": 1
      }
    },
    "202.112.237.226": {
      "alert_count": 5,
      "first_seen": "2026-03-13T07:59:52.925Z",
      "last_seen": "2026-03-30T11:12:36.422Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [],
      "protocols": [
        "IP-in-IP",
        "IPv6"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4538,
      "as_org": "China Education and Research Network Center",
      "threat_score": 26.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.0,
        "persistence": 15.0,
        "diversity": 0,
        "spread": 5,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 18,
        "ports_targeted_30d": 0,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-03-13T07:59:52.925000+00:00",
        "last_seen_30d": "2026-03-30T11:12:36.422000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5
      }
    },
    "43.230.105.61": {
      "alert_count": 5,
      "first_seen": "2026-03-10T03:20:20.648Z",
      "last_seen": "2026-03-10T03:21:32.156Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        8080
      ],
      "protocols": [
        "TCP"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Delhi",
      "asn": 132754,
      "as_org": "Realtel Network Services Pvt Ltd",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-03-10T03:20:20.648000+00:00",
        "last_seen_30d": "2026-03-10T03:21:32.156000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5
      }
    },
    "59.98.206.128": {
      "alert_count": 5,
      "first_seen": "2026-03-08T22:24:24.664Z",
      "last_seen": "2026-03-08T22:25:30.151Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        8080
      ],
      "protocols": [
        "TCP"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Krishnagiri",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-03-08T22:24:24.664000+00:00",
        "last_seen_30d": "2026-03-08T22:25:30.151000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5
      }
    },
    "93.177.151.72": {
      "alert_count": 5,
      "first_seen": "2026-03-14T06:05:39.814Z",
      "last_seen": "2026-03-14T06:06:41.988Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        8080
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Georgia",
      "country_code": "GE",
      "city": "Tbilisi",
      "asn": 16010,
      "as_org": "Magticom Ltd.",
      "threat_score": 6.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-03-14T06:05:39.814000+00:00",
        "last_seen_30d": "2026-03-14T06:06:41.988000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5
      }
    },
    "103.208.105.205": {
      "alert_count": 4,
      "first_seen": "2026-03-30T05:01:11.346Z",
      "last_seen": "2026-03-30T05:02:21.647Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        80
      ],
      "protocols": [
        "TCP"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 24186,
      "as_org": "RailTel Corporation of India Ltd",
      "threat_score": 13.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-03-30T05:01:11.346000+00:00",
        "last_seen_30d": "2026-03-30T05:02:21.647000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4
      }
    },
    "103.84.57.217": {
      "alert_count": 4,
      "first_seen": "2026-03-21T09:32:56.340Z",
      "last_seen": "2026-03-21T09:34:08.540Z",
      "signatures": [
        "ET SCAN JAWS Webserver Unauthenticated Shell Command Execution",
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Web Application Attack"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        60001
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Multan",
      "asn": 141421,
      "as_org": "MUX BROADBAND PRIVATE LIMITED",
      "threat_score": 13.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T09:32:54+00:00",
        "last_seen_30d": "2026-03-21T09:34:08.540000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Honeytrap": 1
      }
    },
    "110.37.78.200": {
      "alert_count": 4,
      "first_seen": "2026-03-06T01:00:55.613Z",
      "last_seen": "2026-03-06T01:02:05.708Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        80
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 38264,
      "as_org": "National WiMAXIMS environment",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-03-06T01:00:55.613000+00:00",
        "last_seen_30d": "2026-03-06T01:02:05.708000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4
      }
    },
    "110.38.248.98": {
      "alert_count": 4,
      "first_seen": "2026-03-30T01:33:30.527Z",
      "last_seen": "2026-03-30T01:43:31.746Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        5555
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 139879,
      "as_org": "Galaxy Broadband",
      "threat_score": 19.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T01:33:11.239000+00:00",
        "last_seen_30d": "2026-03-30T01:43:31.746000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Adbhoney": 2
      }
    },
    "117.235.114.117": {
      "alert_count": 4,
      "first_seen": "2026-03-09T10:55:06.074Z",
      "last_seen": "2026-03-09T10:56:14.454Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        80
      ],
      "protocols": [
        "TCP"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Pati\u0101la",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-03-09T10:55:06.074000+00:00",
        "last_seen_30d": "2026-03-09T10:56:14.454000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4
      }
    },
    "121.225.41.245": {
      "alert_count": 4,
      "first_seen": "2026-03-12T08:08:18.079Z",
      "last_seen": "2026-03-12T08:09:30.445Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        7574
      ],
      "protocols": [
        "TCP"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Nanjing",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T08:08:16+00:00",
        "last_seen_30d": "2026-03-12T08:09:30.445000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Honeytrap": 1
      }
    },
    "202.141.38.186": {
      "alert_count": 4,
      "first_seen": "2026-03-17T19:03:28.719Z",
      "last_seen": "2026-03-17T19:03:28.720Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        7574
      ],
      "protocols": [
        "TCP"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 24186,
      "as_org": "RailTel Corporation of India Ltd",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T19:02:17+00:00",
        "last_seen_30d": "2026-03-17T19:03:28.720000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Honeytrap": 1
      }
    },
    "202.141.95.41": {
      "alert_count": 4,
      "first_seen": "2026-03-02T16:37:03.034Z",
      "last_seen": "2026-03-02T16:47:12.989Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        5555
      ],
      "protocols": [
        "TCP"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 24186,
      "as_org": "RailTel Corporation of India Ltd",
      "threat_score": 2.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T16:36:47.366000+00:00",
        "last_seen_30d": "2026-03-02T16:47:12.989000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Adbhoney": 2
      }
    },
    "222.127.53.189": {
      "alert_count": 4,
      "first_seen": "2026-03-02T22:16:43.500Z",
      "last_seen": "2026-03-02T22:17:52.826Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        80
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Lahug",
      "asn": 132199,
      "as_org": "Globe Telecom Inc.",
      "threat_score": 1.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-03-02T22:16:43.500000+00:00",
        "last_seen_30d": "2026-03-02T22:17:52.826000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4
      }
    },
    "39.87.69.168": {
      "alert_count": 4,
      "first_seen": "2026-03-22T01:28:38.118Z",
      "last_seen": "2026-03-22T01:29:39.803Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        80
      ],
      "protocols": [
        "TCP"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 9.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-03-22T01:28:38.118000+00:00",
        "last_seen_30d": "2026-03-22T01:29:39.803000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4
      }
    },
    "45.230.66.101": {
      "alert_count": 4,
      "first_seen": "2026-03-19T00:00:06.768Z",
      "last_seen": "2026-03-19T00:01:13.872Z",
      "signatures": [
        "ET SCAN JAWS Webserver Unauthenticated Shell Command Execution",
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Web Application Attack"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        80
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Oliveros",
      "asn": 266702,
      "as_org": "MEGALINK S.R.L.",
      "threat_score": 11.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T00:00:06.367000+00:00",
        "last_seen_30d": "2026-03-19T00:01:13.872000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Tanner": 1
      }
    },
    "94.243.10.193": {
      "alert_count": 4,
      "first_seen": "2026-03-25T19:31:16.760Z",
      "last_seen": "2026-03-25T19:42:36.203Z",
      "signatures": [
        "ET SCAN JAWS Webserver Unauthenticated Shell Command Execution",
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Web Application Attack"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        80
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Tyumen",
      "asn": 8359,
      "as_org": "MTS PJSC",
      "threat_score": 15.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-25T19:31:16.379000+00:00",
        "last_seen_30d": "2026-03-25T19:42:36.203000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Tanner": 1
      }
    },
    "89.162.227.117": {
      "alert_count": 3,
      "first_seen": "2026-03-25T16:00:34.388Z",
      "last_seen": "2026-03-26T08:16:42.585Z",
      "signatures": [
        "GPL SCAN loopback traffic"
      ],
      "categories": [
        "Potentially Bad Traffic"
      ],
      "severities": [
        2
      ],
      "dest_ports": [
        65065,
        64210
      ],
      "protocols": [
        "UDP"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Vyshneve",
      "asn": 15895,
      "as_org": "Kyivstar PJSC",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 5,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-03-25T16:00:34.388000+00:00",
        "last_seen_30d": "2026-03-26T08:16:42.585000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3
      }
    },
    "119.202.140.51": {
      "alert_count": 2,
      "first_seen": "2026-03-26T21:45:38.670Z",
      "last_seen": "2026-03-26T21:46:13.286Z",
      "signatures": [
        "GPL SCAN loopback traffic"
      ],
      "categories": [
        "Potentially Bad Traffic"
      ],
      "severities": [
        2
      ],
      "dest_ports": [
        11276
      ],
      "protocols": [
        "UDP"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gumi",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 9.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 3.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 2,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-03-26T21:45:38.670000+00:00",
        "last_seen_30d": "2026-03-26T21:46:13.286000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 2
      }
    },
    "142.117.228.191": {
      "alert_count": 2,
      "first_seen": "2026-03-29T09:01:16.091Z",
      "last_seen": "2026-03-29T09:01:47.054Z",
      "signatures": [
        "GPL SCAN loopback traffic"
      ],
      "categories": [
        "Potentially Bad Traffic"
      ],
      "severities": [
        2
      ],
      "dest_ports": [
        54385
      ],
      "protocols": [
        "UDP"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Montreal",
      "asn": 577,
      "as_org": "Bell Canada",
      "threat_score": 10.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 3.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 2,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-03-29T09:01:16.091000+00:00",
        "last_seen_30d": "2026-03-29T09:01:47.054000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 2
      }
    },
    "91.206.18.102": {
      "alert_count": 2,
      "first_seen": "2026-03-27T17:51:42.693Z",
      "last_seen": "2026-03-27T17:52:16.139Z",
      "signatures": [
        "GPL SCAN loopback traffic"
      ],
      "categories": [
        "Potentially Bad Traffic"
      ],
      "severities": [
        2
      ],
      "dest_ports": [
        27908
      ],
      "protocols": [
        "UDP"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 47397,
      "as_org": "Base Ltd.",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 3.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 2,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-03-27T17:51:42.693000+00:00",
        "last_seen_30d": "2026-03-27T17:52:16.139000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 2
      }
    },
    "172.105.186.116": {
      "alert_count": 1,
      "first_seen": "2026-03-27T19:42:04.400Z",
      "last_seen": "2026-03-27T19:42:04.400Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11910 anomalous ICMPv4 type 3,code 4 Path MTU Discovery"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [],
      "protocols": [
        "ICMP"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 5.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 0.0,
        "persistence": 0.8,
        "diversity": 0,
        "spread": 5,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 1,
        "days_active_30d": 1,
        "ports_targeted_30d": 0,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-03-27T19:42:04.400000+00:00",
        "last_seen_30d": "2026-03-27T19:42:04.400000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1
      }
    },
    "202.112.237.200": {
      "alert_count": 1,
      "first_seen": "2026-03-27T20:52:39.792Z",
      "last_seen": "2026-03-27T20:52:39.792Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11910 anomalous ICMPv4 type 3,code 4 Path MTU Discovery"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [],
      "protocols": [
        "ICMP"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4538,
      "as_org": "China Education and Research Network Center",
      "threat_score": 5.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 0.0,
        "persistence": 0.8,
        "diversity": 0,
        "spread": 5,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 1,
        "days_active_30d": 1,
        "ports_targeted_30d": 0,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-03-27T20:52:39.792000+00:00",
        "last_seen_30d": "2026-03-27T20:52:39.792000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1
      }
    }
  },
  "x_nadsec_summary": {
    "top_countries": {
      "Seychelles": 426668,
      "Germany": 40924,
      "Brazil": 20580,
      "The Netherlands": 5191,
      "France": 4867,
      "Netherlands": 3369,
      "Poland": 840,
      "United States": 536,
      "Slovenia": 92,
      "Iran": 76,
      "India": 63,
      "China": 62,
      "Pakistan": 62,
      "Russia": 38,
      "Taiwan": 26,
      "United Kingdom": 12,
      "Nigeria": 8,
      "Hong Kong": 6,
      "Georgia": 5,
      "Philippines": 4
    },
    "top_asns": {
      "Alsycon B.V.": 426668,
      "Layer7 Networks GmbH": 40888,
      "Oracle Corporation": 20580,
      "Amarutu Technology Ltd": 5157,
      "Contabo GmbH": 4858,
      "Pfcloud UG (haftungsbeschrankt)": 3369,
      "MEVSPACE sp. z o.o.": 840,
      "Hurricane Electric LLC": 536,
      "Netiface LLC": 92,
      "Limited Network LTD": 76,
      "China Education and Research Network Center": 54,
      "CMPak Limited": 40,
      "MTS PJSC": 36,
      "SYNLINQ": 36,
      "Global Layer B.V.": 34,
      "Quadrant Televentures Limited": 21,
      "Data Communication Business Group": 20,
      "National Internet Backbone": 20,
      "M247 Europe SRL": 12,
      "RailTel Corporation of India Ltd": 12
    },
    "top_signatures": {
      "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free": 28,
      "ET SCAN Mirai Variant User-Agent (Inbound)": 27,
      "SURICATA HTTP Unexpected Request body": 6,
      "ET INFO SSH session in progress on Unusual Port": 6,
      "SURICATA STREAM spurious retransmission": 5,
      "ET WEB_SPECIFIC_APPS Spring Framework FileSystemResource Path Traversal (CVE-2024-38816)": 5,
      "SURICATA Applayer Detect protocol only one direction": 5,
      "SURICATA Applayer Mismatch protocol both directions": 5,
      "ET EXPLOIT Possible CVE-2020-11910 anomalous ICMPv4 type 3,code 4 Path MTU Discovery": 5,
      "SURICATA TLS invalid record type": 4,
      "ET SCAN JAWS Webserver Unauthenticated Shell Command Execution": 4,
      "GPL SCAN loopback traffic": 4,
      "SURICATA Applayer Wrong direction first Data": 3,
      "SURICATA STREAM Packet with broken ack": 3,
      "GPL VOIP SIP INVITE message flooding": 2,
      "SURICATA HTTP Request unrecognized authorization method": 2,
      "SURICATA HTTP Request excessive header repetition": 2,
      "ET EXPLOIT F5 TMUI RCE vulnerability CVE-2020-5902 Attempt M1": 2,
      "ET EXPLOIT Multiple DrayTek Products Pre-authentication Remote RCE Inbound (CVE-2020-8515) M2": 2,
      "ET EXPLOIT Possible Sar2HTML plotting tool for Linux servers v3.2.1 (Inbound)": 2,
      "ET EXPLOIT Possible SolarWinds Orion API Local File Disclosure (SWNetPerfMon.db) (CVE-2020-10148)": 2,
      "ET EXPLOIT Possible SolarWinds Orion API Local File Disclosure (web.config) (CVE-2020-10148)": 2,
      "ET INFO Cleartext WordPress Login": 2,
      "SURICATA HTTP Host header invalid": 2,
      "ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound": 2,
      "ET INFO SSH session in progress on Expected Port": 2,
      "SURICATA HTTP missing Host header": 2,
      "GPL ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited": 1,
      "ET EXPLOIT Possible VXWORKS Urgent11 RCE Attempt - Illegal Urgent Flag": 1,
      "ET EXPLOIT Possible VXWORKS Urgent11 RCE Attempt - Urgent Flag": 1
    },
    "top_categories": {
      "Attempted Administrator Privilege Gain": 65,
      "Generic Protocol Command Decode": 17,
      "Web Application Attack": 11,
      "Misc activity": 9,
      "Potentially Bad Traffic": 4,
      "Attempted Denial of Service": 2,
      "Potential Corporate Privacy Violation": 2,
      "Executable code was detected": 1
    },
    "severity_distribution": {
      "1": 71,
      "2": 6,
      "3": 24
    },
    "targeted_ports": {
      "80": 21,
      "443": 16,
      "8080": 15,
      "3000": 9,
      "23": 7,
      "4443": 6,
      "8443": 6,
      "22": 6,
      "8081": 5,
      "4848": 5
    },
    "protocols": {
      "TCP": 68,
      "IP-in-IP": 28,
      "UDP": 24,
      "ICMP": 6,
      "IPv6": 1
    }
  },
  "x_mitre_attack": {
    "techniques": {
      "T1068": {
        "name": "Exploitation for Privilege Escalation",
        "tactic": "Privilege Escalation",
        "ip_count": 65,
        "sample_signatures": []
      },
      "T1190": {
        "name": "Exploit Public-Facing Application",
        "tactic": "Initial Access",
        "ip_count": 47,
        "sample_signatures": [
          "ET EXPLOIT F5 TMUI RCE vulnerability CVE-2020-5902 Attempt M1",
          "ET WEB_SPECIFIC_APPS Spring Framework FileSystemResource Path Traversal (CVE-202",
          "ET WEB_SPECIFIC_APPS Spring Framework FileSystemResource Path Traversal (CVE-202"
        ]
      },
      "T1595": {
        "name": "Active Scanning",
        "tactic": "Reconnaissance",
        "ip_count": 31,
        "sample_signatures": [
          "ET SCAN Mirai Variant User-Agent (Inbound)",
          "ET SCAN JAWS Webserver Unauthenticated Shell Command Execution",
          "GPL SCAN loopback traffic"
        ]
      },
      "T1071": {
        "name": "Application Layer Protocol",
        "tactic": "Command and Control",
        "ip_count": 28,
        "sample_signatures": []
      },
      "T1592": {
        "name": "Gather Victim Host Information",
        "tactic": "Reconnaissance",
        "ip_count": 8,
        "sample_signatures": [
          "ET INFO Cleartext WordPress Login",
          "ET INFO SSH session in progress on Expected Port",
          "ET INFO SSH session in progress on Unusual Port"
        ]
      },
      "T1498": {
        "name": "Network Denial of Service",
        "tactic": "Impact",
        "ip_count": 2,
        "sample_signatures": []
      },
      "T1005": {
        "name": "Data from Local System",
        "tactic": "Collection",
        "ip_count": 2,
        "sample_signatures": []
      },
      "T1059": {
        "name": "Command and Scripting Interpreter",
        "tactic": "Execution",
        "ip_count": 1,
        "sample_signatures": [
          "ET SHELLCODE Adenau Shellcode"
        ]
      }
    },
    "tactic_summary": {
      "Privilege Escalation": 65,
      "Initial Access": 47,
      "Reconnaissance": 39,
      "Command and Control": 28,
      "Impact": 2,
      "Collection": 2,
      "Execution": 1
    },
    "technique_count": 8,
    "primary_tactics": [
      "Privilege Escalation",
      "Initial Access",
      "Reconnaissance"
    ]
  },
  "x_nadsec_threat_summary": {
    "total_ips": 78,
    "scored_ips": 78,
    "threat_distribution": {
      "critical": 3,
      "high": 20,
      "medium": 12,
      "low": 8,
      "minimal": 35,
      "unknown": 0
    },
    "avg_threat_score": 35.9,
    "max_threat_score": 100,
    "top_threats": [
      {
        "ip": "204.76.203.215",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 1963,
        "country": "Netherlands",
        "org": "Pfcloud UG (haftungsbeschrankt)"
      },
      {
        "ip": "183.81.169.235",
        "threat_score": 96.7,
        "threat_level": "critical",
        "total_events": 1750,
        "country": "The Netherlands",
        "org": "Amarutu Technology Ltd"
      },
      {
        "ip": "64.62.156.129",
        "threat_score": 80.6,
        "threat_level": "critical",
        "total_events": 29,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "89.42.231.182",
        "threat_score": 79.9,
        "threat_level": "high",
        "total_events": 3407,
        "country": "The Netherlands",
        "org": "Amarutu Technology Ltd"
      },
      {
        "ip": "64.62.156.79",
        "threat_score": 73.4,
        "threat_level": "high",
        "total_events": 25,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "65.49.1.139",
        "threat_score": 71.7,
        "threat_level": "high",
        "total_events": 25,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "64.62.197.162",
        "threat_score": 70.7,
        "threat_level": "high",
        "total_events": 18,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "64.62.156.151",
        "threat_score": 70.6,
        "threat_level": "high",
        "total_events": 25,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "64.62.156.213",
        "threat_score": 70.3,
        "threat_level": "high",
        "total_events": 31,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "64.62.197.53",
        "threat_score": 70.0,
        "threat_level": "high",
        "total_events": 30,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "65.49.1.127",
        "threat_score": 69.8,
        "threat_level": "high",
        "total_events": 26,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "64.62.197.200",
        "threat_score": 69.8,
        "threat_level": "high",
        "total_events": 25,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "65.49.1.189",
        "threat_score": 69.2,
        "threat_level": "high",
        "total_events": 32,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "184.105.139.119",
        "threat_score": 69.2,
        "threat_level": "high",
        "total_events": 19,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "65.49.1.174",
        "threat_score": 69.0,
        "threat_level": "high",
        "total_events": 20,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "64.62.197.239",
        "threat_score": 67.6,
        "threat_level": "high",
        "total_events": 17,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "65.49.1.203",
        "threat_score": 67.3,
        "threat_level": "high",
        "total_events": 20,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "64.62.197.91",
        "threat_score": 65.9,
        "threat_level": "high",
        "total_events": 15,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "65.49.1.169",
        "threat_score": 65.1,
        "threat_level": "high",
        "total_events": 21,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "64.62.197.69",
        "threat_score": 64.2,
        "threat_level": "high",
        "total_events": 16,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      }
    ]
  }
}