{
  "id": "bundle--f6f04250-4e82-4dc1-b9fb-59bc82c1967c",
  "objects": [
    {
      "created": "2026-04-01T04:10:12.011Z",
      "created_by_ref": "identity--ab072f15-9b87-4ee1-898f-b584d41f29b0",
      "description": "Rolling monthly view of source IPv4 addresses that triggered Suricata severity 1\u20132 (high & medium) IDS alerts on a T-Pot honeypot. Each run looks back the last 1h and appends newly seen IPs for this month. Location: Australia.",
      "id": "report--f6f04250-4e82-4dc1-b9fb-59bc82c1967c",
      "labels": [
        "threat-report"
      ],
      "modified": "2026-04-30T13:10:09.481Z",
      "name": "Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "object_refs": [
        "identity--ab072f15-9b87-4ee1-898f-b584d41f29b0",
        "indicator--c1096574-dce8-4be4-8d2f-17d0c024b1fe",
        "indicator--735e8c2a-b1b4-487c-adcd-b88219c915ad",
        "indicator--81e13fb5-c612-40e8-9d0c-4c4a2d4fdfc9",
        "indicator--c4d11828-191d-49e6-9e29-d100704e3896",
        "indicator--c2d5f91d-ee4e-49b8-b119-7b4a69cd74de",
        "indicator--4d16e566-9e0f-4b87-89c9-ec3ec6034519",
        "indicator--c5199247-f65f-4130-b12d-45040a903d4c",
        "indicator--775b4404-b957-4284-a6e1-95e9332456a4",
        "indicator--33a48547-3268-44b2-a862-a8dc73eaac06",
        "indicator--fd25f079-1a61-46a5-adfe-73a92d2722a5",
        "indicator--fd6a3cbf-409f-41e5-abb4-5b78201f733e",
        "indicator--e051f103-82a9-4596-875b-380594801a83",
        "indicator--dc92ce30-2fd1-4d76-925f-854b8aaa7766",
        "indicator--890da634-a0e0-4689-8057-e8eed22a1f24",
        "indicator--4e8bf5e1-5e63-47d2-a9dd-9d93f8b3f0eb",
        "indicator--f23a63a5-4fa1-4ab2-a15a-8b2800e61ae0",
        "indicator--30893432-559f-4208-94c1-1c407e59bb52",
        "indicator--d89a5671-1187-417e-9205-cc2d79edcc30",
        "indicator--09740608-1dc4-4e5a-93ba-31095caf5d41",
        "indicator--ad156713-e01c-4350-a77c-fc4931c96c8f",
        "indicator--ea6d0784-da74-49c3-a72d-44bf18f18c48",
        "indicator--0cb1476c-5edd-48e0-9baa-dd3f8760b74b",
        "indicator--91f4d0d9-7a38-444a-8cb4-216f5ba94d12",
        "indicator--01cf3588-72ec-4895-aad3-16c0ea6ec65b",
        "indicator--a2a5d526-dc52-4aeb-b322-77b4a32a38f3",
        "indicator--577f2727-af0b-4b08-a9f1-6f7942f5e864",
        "indicator--417b4bd7-3b29-44bc-9fd7-f695592756b3",
        "indicator--c1d102fd-b899-438f-910b-9c27898c9397",
        "indicator--a6df7d12-58db-43a1-85a0-8129399dc1b1",
        "indicator--f790332b-cb1e-4e34-9be0-be9af1aea836",
        "indicator--4531a62d-e729-4ec0-92e5-c344b141dd6e",
        "indicator--80304168-6de2-4067-8153-90079568da76",
        "indicator--af560a6f-463d-4e82-9589-244e2f3f2e2c",
        "indicator--ddb78ce8-0dce-4eb2-b8b8-4af0a211c38e",
        "indicator--9479a040-9947-4966-bf22-371936efa8b8",
        "indicator--3d26a067-77d0-4653-a828-aa9331da84b7",
        "indicator--6d475cff-82a1-4bd7-95c7-bf0541ad7ce8",
        "indicator--eb47e7e0-a6b0-4332-96fd-a175beba65c1",
        "indicator--4fc0ad88-a1de-4515-8ab2-bbf1f09d0c96",
        "indicator--84b49b0a-c7c7-451e-8aff-e576e426773a",
        "indicator--a89e39c1-32bc-4f96-97d8-d26930327a70",
        "indicator--ec76ed43-5f43-4694-ab52-492e31e447c2",
        "indicator--05a0a6ce-e91b-40dc-99e1-583f33d6309c",
        "indicator--3e85dcde-bd93-4a50-add0-fc46e1dba5e5",
        "indicator--379ab17d-426e-4864-9707-72c6a6e58a37",
        "indicator--9d15adbc-26da-45dd-9219-2756241380a8",
        "indicator--8d536184-60a4-4cc0-a29f-a0205db9d81d",
        "indicator--8cab35b0-ac15-4655-94b0-9cf253c5dc30",
        "indicator--803fb9e3-2f20-4906-8063-cda2e9eb2b9b",
        "indicator--1eff8497-a0d7-4fdc-abe9-2ad81778226b",
        "indicator--41f1431e-cea1-4437-b3f1-bb0f7e0bf08b",
        "indicator--c0bb15b4-3206-46d1-8fe5-83c311145477",
        "indicator--be806075-a6ef-4bc3-b4c5-d808bc513809",
        "indicator--d00a69b0-6119-41b8-bea7-71a8fc40837f",
        "indicator--b40c0293-df19-48d3-82d3-33c6364e3aa5",
        "indicator--b2f7d184-9fba-4bc3-b183-a80eeebdbf16",
        "indicator--04fbe69e-79a0-4abe-a133-ca603b90d103",
        "indicator--5dc69d20-a94d-4c9f-906a-70ee805b9eec",
        "indicator--1175ae03-1c35-439d-a0e8-9fa640eb6a79",
        "indicator--3f7e28cb-055d-4c33-a63d-0391efeeec3b",
        "indicator--b00a8967-28ba-4847-a495-7fdfc77a8d65",
        "indicator--3a2f49cb-170d-49fe-a04f-78d464a5030b",
        "indicator--a6740ab4-acc9-41b0-ab25-b7efc3056d10",
        "indicator--6b6f38d7-1b69-49ae-b9c3-13a20fe3b217",
        "indicator--385923ea-1b75-4df0-a476-1f65fc778ea9",
        "indicator--198cd619-fcc0-46dd-b437-00f6f118292d",
        "indicator--519a0f9b-143e-4928-88cd-69e78bb840e9",
        "indicator--e902b0d5-c138-42fc-9950-ab519563023c",
        "indicator--985d3915-c489-4a81-b27b-c080c8d88039",
        "indicator--a47f6779-7e9e-4260-a360-2bc437e7a6c5",
        "indicator--81754a1f-34e8-413d-aef1-70771078bced",
        "indicator--0d1bc85f-8a6e-4962-97f4-67b3948a882f",
        "indicator--7252ca3c-4583-41f6-8d25-0c733e7a76d1",
        "indicator--4a5d70f4-373e-4ab6-979e-c1acf6e4143c",
        "indicator--2ef98dbb-0a99-4301-bf6a-1a9c3cdc1618",
        "indicator--c2691da1-3193-41ee-ab26-99d8bd8f0cae",
        "indicator--cc34d61b-f8e5-4ec2-b96a-a40fb5ab940f",
        "indicator--28b6a135-fe3b-4e3c-b456-047398771d83",
        "indicator--acedf1a3-a912-4cbd-8ecd-3d59223cf982",
        "indicator--c3a74dd9-a42a-4289-978c-8c2d80183413",
        "indicator--606d2e38-6f83-46db-ae07-2845b5fd7f24",
        "indicator--6d3739ee-a64c-45f2-87e9-ec211facf5ed",
        "indicator--7f7bfc53-6765-441c-9115-8c75be554be1",
        "indicator--a0c0b4a3-4857-4c86-b146-c952b7959898",
        "indicator--f7231a6e-4718-4061-af82-a7d29afdcc7d",
        "indicator--1a4a3bb1-ba00-4aa0-b420-e6c359a5664d",
        "indicator--a7fca720-dccd-478d-9820-21eebb79c5ff",
        "indicator--893bcf9c-00fd-4fb0-9253-bebb00545d99",
        "indicator--3357ab0d-bbdf-4418-9e7c-cdff6ad74d0c",
        "indicator--013dc7a7-de7e-4b9e-9d5e-41369b2ea75e",
        "indicator--bc932ac4-b23f-4c7e-807a-cae2fc356076",
        "indicator--ba73ae86-9be4-444c-9835-5625d900eddc",
        "indicator--378c0f1c-330b-4d58-aee8-824527cb9f34",
        "indicator--0693e84e-ac65-45ae-a3d5-24d8337ed6a9",
        "indicator--1425d6d8-fd61-4b5d-8ea7-69eb03df349c",
        "indicator--b1a848e4-a391-49c1-bcad-18ea46d395eb",
        "indicator--ac96b9cc-a302-4e05-b8e1-e8e9289fcb86",
        "indicator--b1d9773d-811d-48ff-bb69-96469f98966a",
        "indicator--ea29d1e4-f93c-41b5-ad19-6357503d3702",
        "indicator--71b3ee38-7605-4b74-8b40-cad087292dbc",
        "indicator--ec561bdc-9be8-4ff8-9cd9-c7bae6323611",
        "indicator--3d833264-adcf-4ece-88d7-e84785b41991",
        "indicator--85bb2a03-dc54-4c98-823a-70ea8b44ee27",
        "indicator--99227e77-3392-4fb7-823f-95e42ff4fa51"
      ],
      "published": "2026-04-01T04:10:12.011Z",
      "spec_version": "2.1",
      "type": "report"
    },
    {
      "contact_information": "https://otx.alienvault.com/",
      "created": "2026-04-01T04:10:12.011Z",
      "id": "identity--ab072f15-9b87-4ee1-898f-b584d41f29b0",
      "identity_class": "organization",
      "modified": "2026-04-01T04:10:12.011Z",
      "name": "Open Threat Exchange",
      "spec_version": "2.1",
      "type": "identity"
    },
    {
      "created": "2026-04-01T04:10:12.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Potentially Bad Traffic; sigs(top)=GPL SCAN loopback traffic; ports=6837; cc=US; asn=138; asn_org=United States Department of Defense DoD",
      "id": "indicator--c1096574-dce8-4be4-8d2f-17d0c024b1fe",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-04-01T04:10:12.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '131.66.226.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T04:10:12.000Z",
      "valid_until": "2026-05-03T04:10:09.000Z"
    },
    {
      "created": "2026-04-01T05:10:02.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=8080; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--735e8c2a-b1b4-487c-adcd-b88219c915ad",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-04-01T05:10:02.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '115.58.133.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T05:10:02.000Z",
      "valid_until": "2026-05-03T05:10:01.000Z"
    },
    {
      "created": "2026-04-01T05:10:02.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11910 anomalous ICMPv4 type 3,code 4 Path MTU Discovery; cc=CN; asn=4538; asn_org=China Education and Research Network Center",
      "id": "indicator--81e13fb5-c612-40e8-9d0c-4c4a2d4fdfc9",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-04-01T05:10:02.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '202.112.237.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T05:10:02.000Z",
      "valid_until": "2026-05-03T05:10:01.000Z"
    },
    {
      "created": "2026-04-01T05:10:02.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--c4d11828-191d-49e6-9e29-d100704e3896",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-04-01T05:10:02.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T05:10:02.000Z",
      "valid_until": "2026-05-03T05:10:01.000Z"
    },
    {
      "created": "2026-04-01T06:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11910 anomalous ICMPv4 type 3,code 4 Path MTU Discovery; cc=AU; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--c2d5f91d-ee4e-49b8-b119-7b4a69cd74de",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-04-01T06:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.105.186.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T06:10:10.000Z",
      "valid_until": "2026-05-03T06:10:09.000Z"
    },
    {
      "created": "2026-04-01T13:10:09.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=80; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--4d16e566-9e0f-4b87-89c9-ec3ec6034519",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-04-01T13:10:09.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '120.240.178.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T13:10:09.000Z",
      "valid_until": "2026-05-03T13:10:08.000Z"
    },
    {
      "created": "2026-04-02T02:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=7574; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--c5199247-f65f-4130-b12d-45040a903d4c",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-04-02T02:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '42.236.213.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T02:10:10.000Z",
      "valid_until": "2026-05-04T02:10:09.000Z"
    },
    {
      "created": "2026-04-02T06:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--775b4404-b957-4284-a6e1-95e9332456a4",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-04-02T06:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '184.105.247.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T06:10:10.000Z",
      "valid_until": "2026-05-04T06:10:09.000Z"
    },
    {
      "created": "2026-04-02T18:10:11.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible Authenticated Command Injection Inbound - Comtrend VR-3033 (CVE-2020-10173); ports=80; cc=TR; asn=34984; asn_org=Superonline Iletisim Hizmetleri A.S.",
      "id": "indicator--33a48547-3268-44b2-a862-a8dc73eaac06",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-04-02T18:10:11.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '176.235.182.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T18:10:11.000Z",
      "valid_until": "2026-05-04T18:10:09.000Z"
    },
    {
      "created": "2026-04-02T21:10:06.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible Authenticated Command Injection Inbound - Comtrend VR-3033 (CVE-2020-10173); ports=80; cc=BR; asn=28227; asn_org=NOVACIA TECNOLOGIA E TELECOMUNICACOES LTDA",
      "id": "indicator--fd25f079-1a61-46a5-adfe-73a92d2722a5",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-04-02T21:10:06.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '186.209.190.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T21:10:06.000Z",
      "valid_until": "2026-05-04T21:10:04.000Z"
    },
    {
      "created": "2026-04-02T22:10:05.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=8080; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--fd6a3cbf-409f-41e5-abb4-5b78201f733e",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-04-02T22:10:05.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '182.127.190.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T22:10:05.000Z",
      "valid_until": "2026-05-04T22:10:04.000Z"
    },
    {
      "created": "2026-04-02T23:10:17.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=CN; asn=4538; asn_org=China Education and Research Network Center",
      "id": "indicator--e051f103-82a9-4596-875b-380594801a83",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-04-02T23:10:17.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '202.112.237.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T23:10:17.000Z",
      "valid_until": "2026-05-04T23:10:09.000Z"
    },
    {
      "created": "2026-04-03T09:10:11.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--dc92ce30-2fd1-4d76-925f-854b8aaa7766",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-04-03T09:10:11.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T09:10:11.000Z",
      "valid_until": "2026-05-05T09:10:09.000Z"
    },
    {
      "created": "2026-04-03T18:10:11.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=49152; cc=PK; asn=9541; asn_org=Cyber Internet Services Pvt Ltd.",
      "id": "indicator--890da634-a0e0-4689-8057-e8eed22a1f24",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-04-03T18:10:11.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '175.107.208.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T18:10:11.000Z",
      "valid_until": "2026-05-05T18:10:09.000Z"
    },
    {
      "created": "2026-04-03T23:10:08.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible Authenticated Command Injection Inbound - Comtrend VR-3033 (CVE-2020-10173); ports=80; cc=AE; asn=5384; asn_org=Emirates Telecommunications Group Company (etisalat Group) Pjsc",
      "id": "indicator--4e8bf5e1-5e63-47d2-a9dd-9d93f8b3f0eb",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-04-03T23:10:08.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '5.38.0.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T23:10:08.000Z",
      "valid_until": "2026-05-05T23:10:03.000Z"
    },
    {
      "created": "2026-04-04T08:10:11.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible Authenticated Command Injection Inbound - Comtrend VR-3033 (CVE-2020-10173); ports=80; cc=US; asn=7922; asn_org=Comcast Cable Communications, LLC",
      "id": "indicator--f23a63a5-4fa1-4ab2-a15a-8b2800e61ae0",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-04-04T08:10:11.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '107.4.24.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T08:10:11.000Z",
      "valid_until": "2026-05-06T08:10:10.000Z"
    },
    {
      "created": "2026-04-04T08:10:11.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--30893432-559f-4208-94c1-1c407e59bb52",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-04-04T08:10:11.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T08:10:11.000Z",
      "valid_until": "2026-05-06T08:10:10.000Z"
    },
    {
      "created": "2026-04-04T09:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=49152; cc=ID; asn=141140; asn_org=PT Jinde Grup Indonesia",
      "id": "indicator--d89a5671-1187-417e-9205-cc2d79edcc30",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-04-04T09:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.93.93.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T09:10:10.000Z",
      "valid_until": "2026-05-06T09:10:09.000Z"
    },
    {
      "created": "2026-04-04T15:10:23.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible Authenticated Command Injection Inbound - Comtrend VR-3033 (CVE-2020-10173); ports=80; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--09740608-1dc4-4e5a-93ba-31095caf5d41",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-04-04T15:10:23.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '69.55.60.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T15:10:23.000Z",
      "valid_until": "2026-05-06T15:10:08.000Z"
    },
    {
      "created": "2026-04-04T15:10:23.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible Authenticated Command Injection Inbound - Comtrend VR-3033 (CVE-2020-10173); ports=80; cc=US; asn=20001; asn_org=Charter Communications Inc",
      "id": "indicator--ad156713-e01c-4350-a77c-fc4931c96c8f",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-04-04T15:10:23.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '98.147.139.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T15:10:23.000Z",
      "valid_until": "2026-05-06T15:10:08.000Z"
    },
    {
      "created": "2026-04-04T16:10:12.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=2; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible VXWORKS Urgent11 RCE Attempt - Illegal Urgent Flag; ET EXPLOIT Possible VXWORKS Urgent11 RCE Attempt - Urgent Flag; ports=43317; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--ea6d0784-da74-49c3-a72d-44bf18f18c48",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-04-04T16:10:12.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '1.34.85.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T16:10:12.000Z",
      "valid_until": "2026-05-06T16:10:08.000Z"
    },
    {
      "created": "2026-04-05T06:10:06.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=80; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--0cb1476c-5edd-48e0-9baa-dd3f8760b74b",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-04-05T06:10:06.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '117.244.67.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T06:10:06.000Z",
      "valid_until": "2026-05-07T06:10:04.000Z"
    },
    {
      "created": "2026-04-05T06:10:06.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--91f4d0d9-7a38-444a-8cb4-216f5ba94d12",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-04-05T06:10:06.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T06:10:06.000Z",
      "valid_until": "2026-05-07T06:10:04.000Z"
    },
    {
      "created": "2026-04-06T04:10:11.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible Authenticated Command Injection Inbound - Comtrend VR-3033 (CVE-2020-10173); ports=80; cc=PY; asn=14593; asn_org=Space Exploration Technologies Corporation",
      "id": "indicator--01cf3588-72ec-4895-aad3-16c0ea6ec65b",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-04-06T04:10:11.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '148.222.129.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T04:10:11.000Z",
      "valid_until": "2026-05-08T04:10:09.000Z"
    },
    {
      "created": "2026-04-06T05:10:06.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible Authenticated Command Injection Inbound - Comtrend VR-3033 (CVE-2020-10173); ports=80; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--a2a5d526-dc52-4aeb-b322-77b4a32a38f3",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-04-06T05:10:06.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '105.99.123.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T05:10:06.000Z",
      "valid_until": "2026-05-08T05:10:04.000Z"
    },
    {
      "created": "2026-04-06T07:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=80; cc=PK; asn=58470; asn_org=IX Peering for Mobilink and Link Direct International.",
      "id": "indicator--577f2727-af0b-4b08-a9f1-6f7942f5e864",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-04-06T07:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '119.30.116.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T07:10:10.000Z",
      "valid_until": "2026-05-08T07:10:09.000Z"
    },
    {
      "created": "2026-04-06T09:10:11.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--417b4bd7-3b29-44bc-9fd7-f695592756b3",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-04-06T09:10:11.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T09:10:11.000Z",
      "valid_until": "2026-05-08T09:10:09.000Z"
    },
    {
      "created": "2026-04-06T10:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible Authenticated Command Injection Inbound - Comtrend VR-3033 (CVE-2020-10173); ports=80; cc=US; asn=7922; asn_org=Comcast Cable Communications, LLC",
      "id": "indicator--c1d102fd-b899-438f-910b-9c27898c9397",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-04-06T10:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '68.40.127.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T10:10:10.000Z",
      "valid_until": "2026-05-08T10:10:09.000Z"
    },
    {
      "created": "2026-04-06T14:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible Authenticated Command Injection Inbound - Comtrend VR-3033 (CVE-2020-10173); ports=80; cc=CL; asn=27901; asn_org=Pacifico Cable SPA.",
      "id": "indicator--a6df7d12-58db-43a1-85a0-8129399dc1b1",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-04-06T14:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '190.114.40.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T14:10:10.000Z",
      "valid_until": "2026-05-08T14:10:09.000Z"
    },
    {
      "created": "2026-04-07T05:10:09.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible Authenticated Command Injection Inbound - Comtrend VR-3033 (CVE-2020-10173); ports=80; cc=US; asn=20001; asn_org=Charter Communications Inc",
      "id": "indicator--f790332b-cb1e-4e34-9be0-be9af1aea836",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-04-07T05:10:09.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.240.197.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T05:10:09.000Z",
      "valid_until": "2026-05-09T05:10:08.000Z"
    },
    {
      "created": "2026-04-07T07:10:05.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Potentially Bad Traffic; sigs(top)=GPL SCAN loopback traffic; ports=37802; cc=US; asn=701; asn_org=Verizon Business",
      "id": "indicator--4531a62d-e729-4ec0-92e5-c344b141dd6e",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-04-07T07:10:05.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '71.102.182.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T07:10:05.000Z",
      "valid_until": "2026-05-09T07:10:04.000Z"
    },
    {
      "created": "2026-04-07T09:10:09.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--80304168-6de2-4067-8153-90079568da76",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-04-07T09:10:09.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T09:10:09.000Z",
      "valid_until": "2026-05-09T09:10:08.000Z"
    },
    {
      "created": "2026-04-07T16:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11910 anomalous ICMPv4 type 3,code 4 Path MTU Discovery; cc=IN; asn=17917; asn_org=Quadrant Televentures Limited",
      "id": "indicator--af560a6f-463d-4e82-9589-244e2f3f2e2c",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-04-07T16:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '112.196.109.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T16:10:10.000Z",
      "valid_until": "2026-05-09T16:10:09.000Z"
    },
    {
      "created": "2026-04-07T22:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Potentially Bad Traffic; sigs(top)=GPL SCAN loopback traffic; ports=61083; cc=KR; asn=9946; asn_org=KCTV JEJU BROADCASTING",
      "id": "indicator--ddb78ce8-0dce-4eb2-b8b8-4af0a211c38e",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-04-07T22:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '122.202.169.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T22:10:10.000Z",
      "valid_until": "2026-05-09T22:10:08.000Z"
    },
    {
      "created": "2026-04-08T14:10:04.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Potentially Bad Traffic; sigs(top)=GPL SCAN loopback traffic; ports=17670; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--9479a040-9947-4966-bf22-371936efa8b8",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-04-08T14:10:04.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '3.95.117.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T14:10:04.000Z",
      "valid_until": "2026-05-10T14:10:04.000Z"
    },
    {
      "created": "2026-04-08T20:10:05.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible Authenticated Command Injection Inbound - Comtrend VR-3033 (CVE-2020-10173); ports=80; cc=EC; asn=52468; asn_org=UFINET PANAMA S.A.",
      "id": "indicator--3d26a067-77d0-4653-a828-aa9331da84b7",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-04-08T20:10:05.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '157.100.58.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T20:10:05.000Z",
      "valid_until": "2026-05-10T20:10:03.000Z"
    },
    {
      "created": "2026-04-08T21:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=5; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11910 anomalous ICMPv4 type 3,code 4 Path MTU Discovery; cc=US; asn=35916; asn_org=MULTACOM CORPORATION",
      "id": "indicator--6d475cff-82a1-4bd7-95c7-bf0541ad7ce8",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-04-08T21:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '148.135.1.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T21:10:10.000Z",
      "valid_until": "2026-05-10T21:10:09.000Z"
    },
    {
      "created": "2026-04-09T00:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--eb47e7e0-a6b0-4332-96fd-a175beba65c1",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-04-09T00:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T00:10:10.000Z",
      "valid_until": "2026-05-11T00:10:09.000Z"
    },
    {
      "created": "2026-04-09T10:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Potentially Bad Traffic; sigs(top)=GPL SCAN loopback traffic; ports=11127; cc=GB",
      "id": "indicator--4fc0ad88-a1de-4515-8ab2-bbf1f09d0c96",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-04-09T10:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '25.85.41.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T10:10:10.000Z",
      "valid_until": "2026-05-11T10:10:09.000Z"
    },
    {
      "created": "2026-04-10T02:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible Authenticated Command Injection Inbound - Comtrend VR-3033 (CVE-2020-10173); ports=80; cc=US; asn=14593; asn_org=Space Exploration Technologies Corporation",
      "id": "indicator--84b49b0a-c7c7-451e-8aff-e576e426773a",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-04-10T02:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '74.244.109.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T02:10:10.000Z",
      "valid_until": "2026-05-12T02:10:09.000Z"
    },
    {
      "created": "2026-04-10T04:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible Authenticated Command Injection Inbound - Comtrend VR-3033 (CVE-2020-10173); ports=80; cc=US; asn=10796; asn_org=Charter Communications Inc",
      "id": "indicator--a89e39c1-32bc-4f96-97d8-d26930327a70",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-04-10T04:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '24.95.137.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T04:10:10.000Z",
      "valid_until": "2026-05-12T04:10:09.000Z"
    },
    {
      "created": "2026-04-10T08:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible Authenticated Command Injection Inbound - Comtrend VR-3033 (CVE-2020-10173); ports=80; cc=BR; asn=28258; asn_org=VERO S.A",
      "id": "indicator--ec76ed43-5f43-4694-ab52-492e31e447c2",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-04-10T08:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '186.235.99.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T08:10:10.000Z",
      "valid_until": "2026-05-12T08:10:09.000Z"
    },
    {
      "created": "2026-04-10T08:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--05a0a6ce-e91b-40dc-99e1-583f33d6309c",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-04-10T08:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T08:10:10.000Z",
      "valid_until": "2026-05-12T08:10:09.000Z"
    },
    {
      "created": "2026-04-10T13:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Potentially Bad Traffic; sigs(top)=GPL SCAN loopback traffic; ports=40003; cc=US; asn=749; asn_org=United States Department of Defense DoD",
      "id": "indicator--3e85dcde-bd93-4a50-add0-fc46e1dba5e5",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-04-10T13:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '128.26.175.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T13:10:10.000Z",
      "valid_until": "2026-05-12T13:10:09.000Z"
    },
    {
      "created": "2026-04-10T16:10:11.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible Authenticated Command Injection Inbound - Comtrend VR-3033 (CVE-2020-10173); ports=80; cc=ZA; asn=11845; asn_org=Vox-Telecom",
      "id": "indicator--379ab17d-426e-4864-9707-72c6a6e58a37",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-04-10T16:10:11.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '102.219.27.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T16:10:11.000Z",
      "valid_until": "2026-05-12T16:10:10.000Z"
    },
    {
      "created": "2026-04-11T02:10:25.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=2; categories=Attempted Administrator Privilege Gain,Web Application Attack; sigs(top)=ET SCAN JAWS Webserver Unauthenticated Shell Command Execution; ET SCAN Mirai Variant User-Agent (Inbound); ports=80; cc=CN; asn=17622; asn_org=China Unicom Guangzhou network",
      "id": "indicator--9d15adbc-26da-45dd-9219-2756241380a8",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-04-11T02:10:25.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '120.85.113.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T02:10:25.000Z",
      "valid_until": "2026-05-13T02:10:04.000Z"
    },
    {
      "created": "2026-04-11T04:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Potentially Bad Traffic; sigs(top)=GPL SCAN loopback traffic; ports=46684; cc=JP; asn=17676; asn_org=SoftBank Corp.",
      "id": "indicator--8d536184-60a4-4cc0-a29f-a0205db9d81d",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-04-11T04:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '221.20.152.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T04:10:10.000Z",
      "valid_until": "2026-05-13T04:10:09.000Z"
    },
    {
      "created": "2026-04-11T05:10:04.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--8cab35b0-ac15-4655-94b0-9cf253c5dc30",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-04-11T05:10:04.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T05:10:04.000Z",
      "valid_until": "2026-05-13T05:10:03.000Z"
    },
    {
      "created": "2026-04-11T18:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=7574; cc=PK; asn=9541; asn_org=Cyber Internet Services Pvt Ltd.",
      "id": "indicator--803fb9e3-2f20-4906-8063-cda2e9eb2b9b",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-04-11T18:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '36.255.45.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T18:10:10.000Z",
      "valid_until": "2026-05-13T18:10:09.000Z"
    },
    {
      "created": "2026-04-11T20:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=2; categories=Attempted Administrator Privilege Gain,Web Application Attack; sigs(top)=ET SCAN JAWS Webserver Unauthenticated Shell Command Execution; ET SCAN Mirai Variant User-Agent (Inbound); ports=60001; cc=IN; asn=135761; asn_org=Userlinks Netcom Pvt. Ltd.",
      "id": "indicator--1eff8497-a0d7-4fdc-abe9-2ad81778226b",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-04-11T20:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.38.53.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T20:10:10.000Z",
      "valid_until": "2026-05-13T20:10:09.000Z"
    },
    {
      "created": "2026-04-11T23:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Potentially Bad Traffic; sigs(top)=GPL SCAN loopback traffic; ports=32865; cc=SG; asn=63526; asn_org=Systems Solutions & development Technologies Limited",
      "id": "indicator--41f1431e-cea1-4437-b3f1-bb0f7e0bf08b",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-04-11T23:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.249.103.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T23:10:10.000Z",
      "valid_until": "2026-05-13T23:10:09.000Z"
    },
    {
      "created": "2026-04-12T09:10:05.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--c0bb15b4-3206-46d1-8fe5-83c311145477",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-04-12T09:10:05.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T09:10:05.000Z",
      "valid_until": "2026-05-14T09:10:03.000Z"
    },
    {
      "created": "2026-04-12T10:10:37.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=80; cc=PK; asn=38264; asn_org=National WiMAXIMS environment",
      "id": "indicator--be806075-a6ef-4bc3-b4c5-d808bc513809",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-04-12T10:10:37.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '110.37.9.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T10:10:37.000Z",
      "valid_until": "2026-05-14T10:10:07.000Z"
    },
    {
      "created": "2026-04-12T21:11:07.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible Authenticated Command Injection Inbound - Comtrend VR-3033 (CVE-2020-10173); ports=80; cc=AU; asn=4804; asn_org=Microplex PTY LTD",
      "id": "indicator--d00a69b0-6119-41b8-bea7-71a8fc40837f",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-04-12T21:11:07.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '1.40.204.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T21:11:07.000Z",
      "valid_until": "2026-05-14T21:10:09.000Z"
    },
    {
      "created": "2026-04-13T05:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=5555; cc=PK; asn=9541; asn_org=Cyber Internet Services Pvt Ltd.",
      "id": "indicator--b40c0293-df19-48d3-82d3-33c6364e3aa5",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-04-13T05:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '175.107.237.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T05:10:10.000Z",
      "valid_until": "2026-05-15T05:10:09.000Z"
    },
    {
      "created": "2026-04-13T17:10:05.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--b2f7d184-9fba-4bc3-b183-a80eeebdbf16",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-04-13T17:10:05.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '184.105.247.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T17:10:05.000Z",
      "valid_until": "2026-05-15T17:10:04.000Z"
    },
    {
      "created": "2026-04-13T23:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Potentially Bad Traffic; sigs(top)=GPL SCAN loopback traffic; ports=1594; cc=US",
      "id": "indicator--04fbe69e-79a0-4abe-a133-ca603b90d103",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-04-13T23:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '19.79.13.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T23:10:10.000Z",
      "valid_until": "2026-05-15T23:10:09.000Z"
    },
    {
      "created": "2026-04-14T16:10:18.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible Authenticated Command Injection Inbound - Comtrend VR-3033 (CVE-2020-10173); ports=80; cc=US; asn=7922; asn_org=Comcast Cable Communications, LLC",
      "id": "indicator--5dc69d20-a94d-4c9f-906a-70ee805b9eec",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-04-14T16:10:18.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '24.9.196.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T16:10:18.000Z",
      "valid_until": "2026-05-16T16:10:04.000Z"
    },
    {
      "created": "2026-04-14T23:10:12.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=5555; cc=PK; asn=9541; asn_org=Cyber Internet Services Pvt Ltd.",
      "id": "indicator--1175ae03-1c35-439d-a0e8-9fa640eb6a79",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-04-14T23:10:12.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '139.135.46.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T23:10:12.000Z",
      "valid_until": "2026-05-16T23:10:10.000Z"
    },
    {
      "created": "2026-04-15T04:10:12.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=2; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=7547; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--3f7e28cb-055d-4c33-a63d-0391efeeec3b",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-04-15T04:10:12.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '114.33.222.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T04:10:12.000Z",
      "valid_until": "2026-05-17T04:10:09.000Z"
    },
    {
      "created": "2026-04-15T13:10:11.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=8080; cc=IN; asn=138245; asn_org=Xpress Net Solution",
      "id": "indicator--b00a8967-28ba-4847-a495-7fdfc77a8d65",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-04-15T13:10:11.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.181.160.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T13:10:11.000Z",
      "valid_until": "2026-05-17T13:10:10.000Z"
    },
    {
      "created": "2026-04-15T22:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Potentially Bad Traffic; sigs(top)=GPL SCAN loopback traffic; ports=7682; cc=CN; asn=10212; asn_org=China Enterprise ICT Solutions Limited",
      "id": "indicator--3a2f49cb-170d-49fe-a04f-78d464a5030b",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-04-15T22:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '218.97.90.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T22:10:10.000Z",
      "valid_until": "2026-05-17T22:10:09.000Z"
    },
    {
      "created": "2026-04-16T02:10:05.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound; ports=55555; cc=US; asn=6181; asn_org=Cincinnati Bell Telephone Company LLC",
      "id": "indicator--a6740ab4-acc9-41b0-ab25-b7efc3056d10",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-04-16T02:10:05.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.59.33.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T02:10:05.000Z",
      "valid_until": "2026-05-18T02:10:03.000Z"
    },
    {
      "created": "2026-04-16T02:10:05.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=5555; cc=PK; asn=9541; asn_org=Cyber Internet Services Pvt Ltd.",
      "id": "indicator--6b6f38d7-1b69-49ae-b9c3-13a20fe3b217",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-04-16T02:10:05.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '72.255.26.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T02:10:05.000Z",
      "valid_until": "2026-05-18T02:10:03.000Z"
    },
    {
      "created": "2026-04-16T02:10:05.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible Authenticated Command Injection Inbound - Comtrend VR-3033 (CVE-2020-10173); ports=80; cc=US; asn=6181; asn_org=Cincinnati Bell Telephone Company LLC",
      "id": "indicator--385923ea-1b75-4df0-a476-1f65fc778ea9",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-04-16T02:10:05.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '72.49.246.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T02:10:05.000Z",
      "valid_until": "2026-05-18T02:10:03.000Z"
    },
    {
      "created": "2026-04-16T06:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--198cd619-fcc0-46dd-b437-00f6f118292d",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-04-16T06:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '184.105.139.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T06:10:10.000Z",
      "valid_until": "2026-05-18T06:10:09.000Z"
    },
    {
      "created": "2026-04-16T16:10:11.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=7574; cc=PK; asn=9541; asn_org=Cyber Internet Services Pvt Ltd.",
      "id": "indicator--519a0f9b-143e-4928-88cd-69e78bb840e9",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-04-16T16:10:11.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '72.255.19.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T16:10:11.000Z",
      "valid_until": "2026-05-18T16:10:09.000Z"
    },
    {
      "created": "2026-04-16T20:10:32.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Potentially Bad Traffic; sigs(top)=GPL SCAN loopback traffic; ports=28230; cc=DE; asn=3320; asn_org=Deutsche Telekom AG",
      "id": "indicator--e902b0d5-c138-42fc-9950-ab519563023c",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-04-16T20:10:32.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '2.171.236.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T20:10:32.000Z",
      "valid_until": "2026-05-18T20:10:09.000Z"
    },
    {
      "created": "2026-04-17T01:10:04.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=5555; cc=PK; asn=9541; asn_org=Cyber Internet Services Pvt Ltd.",
      "id": "indicator--985d3915-c489-4a81-b27b-c080c8d88039",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-04-17T01:10:04.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '175.107.211.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T01:10:04.000Z",
      "valid_until": "2026-05-19T01:10:03.000Z"
    },
    {
      "created": "2026-04-17T09:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--a47f6779-7e9e-4260-a360-2bc437e7a6c5",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-04-17T09:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T09:10:10.000Z",
      "valid_until": "2026-05-19T09:10:09.000Z"
    },
    {
      "created": "2026-04-17T22:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=80; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--81754a1f-34e8-413d-aef1-70771078bced",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-04-17T22:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '222.137.83.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T22:10:10.000Z",
      "valid_until": "2026-05-19T22:10:08.000Z"
    },
    {
      "created": "2026-04-18T07:10:11.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--0d1bc85f-8a6e-4962-97f4-67b3948a882f",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-04-18T07:10:11.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T07:10:11.000Z",
      "valid_until": "2026-05-20T07:10:09.000Z"
    },
    {
      "created": "2026-04-18T16:10:11.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=7; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11910 anomalous ICMPv4 type 3,code 4 Path MTU Discovery; cc=DE; asn=200187; asn_org=CloudKleyer Frankfurt GmbH",
      "id": "indicator--7252ca3c-4583-41f6-8d25-0c733e7a76d1",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-04-18T16:10:11.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.35.147.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T16:10:11.000Z",
      "valid_until": "2026-05-20T16:10:09.000Z"
    },
    {
      "created": "2026-04-19T09:10:09.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--4a5d70f4-373e-4ab6-979e-c1acf6e4143c",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-04-19T09:10:09.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T09:10:09.000Z",
      "valid_until": "2026-05-21T09:10:08.000Z"
    },
    {
      "created": "2026-04-19T15:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Potential Corporate Privacy Violation; sigs(top)=ET INFO Cleartext WordPress Login; ports=8080; cc=GB; asn=13335; asn_org=Cloudflare, Inc.",
      "id": "indicator--2ef98dbb-0a99-4301-bf6a-1a9c3cdc1618",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-04-19T15:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.28.164.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T15:10:10.000Z",
      "valid_until": "2026-05-21T15:10:09.000Z"
    },
    {
      "created": "2026-04-19T15:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=49152; cc=PK; asn=9541; asn_org=Cyber Internet Services Pvt Ltd.",
      "id": "indicator--c2691da1-3193-41ee-ab26-99d8bd8f0cae",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-04-19T15:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '175.107.221.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T15:10:10.000Z",
      "valid_until": "2026-05-21T15:10:09.000Z"
    },
    {
      "created": "2026-04-19T18:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible Authenticated Command Injection Inbound - Comtrend VR-3033 (CVE-2020-10173); ports=80; cc=US; asn=21928; asn_org=T-Mobile USA, Inc.",
      "id": "indicator--cc34d61b-f8e5-4ec2-b96a-a40fb5ab940f",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-04-19T18:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.59.35.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T18:10:10.000Z",
      "valid_until": "2026-05-21T18:10:09.000Z"
    },
    {
      "created": "2026-04-19T23:10:09.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=2; categories=Attempted Administrator Privilege Gain,Web Application Attack; sigs(top)=ET SCAN JAWS Webserver Unauthenticated Shell Command Execution; ET SCAN Mirai Variant User-Agent (Inbound); ports=80; cc=AR; asn=266702; asn_org=MEGALINK S.R.L.",
      "id": "indicator--28b6a135-fe3b-4e3c-b456-047398771d83",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-04-19T23:10:09.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.230.66.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T23:10:09.000Z",
      "valid_until": "2026-05-21T23:10:08.000Z"
    },
    {
      "created": "2026-04-20T02:10:02.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--acedf1a3-a912-4cbd-8ecd-3d59223cf982",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-04-20T02:10:02.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T02:10:02.000Z",
      "valid_until": "2026-05-22T02:10:00.000Z"
    },
    {
      "created": "2026-04-20T11:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=2; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible Authenticated Command Injection Inbound - Comtrend VR-3033 (CVE-2020-10173); ports=80; cc=US; asn=7018; asn_org=AT&T Enterprises, LLC",
      "id": "indicator--c3a74dd9-a42a-4289-978c-8c2d80183413",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-04-20T11:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '107.205.30.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T11:10:10.000Z",
      "valid_until": "2026-05-22T11:10:09.000Z"
    },
    {
      "created": "2026-04-20T20:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=49152; cc=PK; asn=9541; asn_org=Cyber Internet Services Pvt Ltd.",
      "id": "indicator--606d2e38-6f83-46db-ae07-2845b5fd7f24",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-04-20T20:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '72.255.18.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T20:10:10.000Z",
      "valid_until": "2026-05-22T20:10:08.000Z"
    },
    {
      "created": "2026-04-20T23:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Potentially Bad Traffic; sigs(top)=GPL SCAN loopback traffic; ports=43807; cc=TZ",
      "id": "indicator--6d3739ee-a64c-45f2-87e9-ec211facf5ed",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-04-20T23:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '156.159.40.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T23:10:10.000Z",
      "valid_until": "2026-05-22T23:10:09.000Z"
    },
    {
      "created": "2026-04-21T09:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--7f7bfc53-6765-441c-9115-8c75be554be1",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-04-21T09:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T09:10:10.000Z",
      "valid_until": "2026-05-23T09:10:09.000Z"
    },
    {
      "created": "2026-04-21T20:10:16.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=80; cc=IN; asn=141275; asn_org=Maxnet Digital Pvt Ltd",
      "id": "indicator--a0c0b4a3-4857-4c86-b146-c952b7959898",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-04-21T20:10:16.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.99.196.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T20:10:16.000Z",
      "valid_until": "2026-05-23T20:10:09.000Z"
    },
    {
      "created": "2026-04-22T06:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--f7231a6e-4718-4061-af82-a7d29afdcc7d",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-04-22T06:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T06:10:10.000Z",
      "valid_until": "2026-05-24T06:10:09.000Z"
    },
    {
      "created": "2026-04-22T07:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=49152; cc=RU; asn=28890; asn_org=INSYS LLC",
      "id": "indicator--1a4a3bb1-ba00-4aa0-b420-e6c359a5664d",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-04-22T07:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '5.172.22.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T07:10:10.000Z",
      "valid_until": "2026-05-24T07:10:09.000Z"
    },
    {
      "created": "2026-04-22T09:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=80; cc=AU; asn=9443; asn_org=Vocus Retail",
      "id": "indicator--a7fca720-dccd-478d-9820-21eebb79c5ff",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-04-22T09:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '139.218.43.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T09:10:10.000Z",
      "valid_until": "2026-05-24T09:10:09.000Z"
    },
    {
      "created": "2026-04-22T22:10:24.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=80; cc=IN; asn=135761; asn_org=Userlinks Netcom Pvt. Ltd.",
      "id": "indicator--893bcf9c-00fd-4fb0-9253-bebb00545d99",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-04-22T22:10:24.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.160.197.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T22:10:24.000Z",
      "valid_until": "2026-05-24T22:10:08.000Z"
    },
    {
      "created": "2026-04-23T22:10:31.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=49152; cc=CN; asn=17622; asn_org=China Unicom Guangzhou network",
      "id": "indicator--3357ab0d-bbdf-4418-9e7c-cdff6ad74d0c",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-04-23T22:10:31.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '120.85.118.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T22:10:31.000Z",
      "valid_until": "2026-05-25T22:10:09.000Z"
    },
    {
      "created": "2026-04-24T05:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Potentially Bad Traffic; sigs(top)=GPL SCAN loopback traffic; ports=3417; cc=DZ; asn=327712; asn_org=ATM",
      "id": "indicator--013dc7a7-de7e-4b9e-9d5e-41369b2ea75e",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-04-24T05:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '154.121.188.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T05:10:10.000Z",
      "valid_until": "2026-05-26T05:10:09.000Z"
    },
    {
      "created": "2026-04-24T08:10:09.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--bc932ac4-b23f-4c7e-807a-cae2fc356076",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-04-24T08:10:09.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '184.105.247.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T08:10:09.000Z",
      "valid_until": "2026-05-26T08:10:08.000Z"
    },
    {
      "created": "2026-04-25T22:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=7574; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--ba73ae86-9be4-444c-9835-5625d900eddc",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-04-25T22:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '119.185.166.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T22:10:10.000Z",
      "valid_until": "2026-05-27T22:10:09.000Z"
    },
    {
      "created": "2026-04-26T08:10:13.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Potentially Bad Traffic; sigs(top)=GPL SCAN loopback traffic; ports=28467; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--378c0f1c-330b-4d58-aee8-824527cb9f34",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-04-26T08:10:13.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '51.244.213.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T08:10:13.000Z",
      "valid_until": "2026-05-28T08:10:12.000Z"
    },
    {
      "created": "2026-04-26T09:10:02.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=80; cc=NI; asn=263765; asn_org=XINWEI INTELCOM.NIC, S.A.",
      "id": "indicator--0693e84e-ac65-45ae-a3d5-24d8337ed6a9",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-04-26T09:10:02.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '170.84.134.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T09:10:02.000Z",
      "valid_until": "2026-05-28T09:10:01.000Z"
    },
    {
      "created": "2026-04-26T09:10:02.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--1425d6d8-fd61-4b5d-8ea7-69eb03df349c",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-04-26T09:10:02.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T09:10:02.000Z",
      "valid_until": "2026-05-28T09:10:01.000Z"
    },
    {
      "created": "2026-04-27T04:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=80; cc=PK; asn=38264; asn_org=National WiMAXIMS environment",
      "id": "indicator--b1a848e4-a391-49c1-bcad-18ea46d395eb",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-04-27T04:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '110.37.31.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T04:10:10.000Z",
      "valid_until": "2026-05-29T04:10:08.000Z"
    },
    {
      "created": "2026-04-27T07:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--ac96b9cc-a302-4e05-b8e1-e8e9289fcb86",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-04-27T07:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T07:10:10.000Z",
      "valid_until": "2026-05-29T07:10:09.000Z"
    },
    {
      "created": "2026-04-27T21:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=49152; cc=PH; asn=132199; asn_org=Globe Telecom Inc.",
      "id": "indicator--b1d9773d-811d-48ff-bb69-96469f98966a",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-04-27T21:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '120.28.124.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T21:10:10.000Z",
      "valid_until": "2026-05-29T21:10:08.000Z"
    },
    {
      "created": "2026-04-28T09:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--ea29d1e4-f93c-41b5-ad19-6357503d3702",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-04-28T09:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '184.105.139.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T09:10:10.000Z",
      "valid_until": "2026-05-30T09:10:09.000Z"
    },
    {
      "created": "2026-04-30T00:10:11.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible Authenticated Command Injection Inbound - Comtrend VR-3033 (CVE-2020-10173); ports=80; cc=US; asn=14593; asn_org=Space Exploration Technologies Corporation",
      "id": "indicator--71b3ee38-7605-4b74-8b40-cad087292dbc",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-04-30T00:10:11.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '98.97.37.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T00:10:11.000Z",
      "valid_until": "2026-06-01T00:10:09.000Z"
    },
    {
      "created": "2026-04-30T05:10:09.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=5; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11910 anomalous ICMPv4 type 3,code 4 Path MTU Discovery; cc=US; asn=174; asn_org=Cogent Communications, LLC",
      "id": "indicator--ec561bdc-9be8-4ff8-9cd9-c7bae6323611",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-04-30T05:10:09.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '102.129.152.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T05:10:09.000Z",
      "valid_until": "2026-06-01T05:10:08.000Z"
    },
    {
      "created": "2026-04-30T07:10:05.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--3d833264-adcf-4ece-88d7-e84785b41991",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-04-30T07:10:05.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T07:10:05.000Z",
      "valid_until": "2026-06-01T07:10:04.000Z"
    },
    {
      "created": "2026-04-30T10:10:09.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=8080; cc=IN; asn=135687; asn_org=Qwistel Network Service Private Limited",
      "id": "indicator--85bb2a03-dc54-4c98-823a-70ea8b44ee27",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-04-30T10:10:09.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.176.16.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T10:10:09.000Z",
      "valid_until": "2026-06-01T10:10:08.000Z"
    },
    {
      "created": "2026-04-30T13:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Potentially Bad Traffic; sigs(top)=ET REMOTE_ACCESS Tunneled RDP msts Handshake; ports=61871; cc=NL; asn=202425; asn_org=IP Volume inc",
      "id": "indicator--99227e77-3392-4fb7-823f-95e42ff4fa51",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-04-30T13:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '94.102.49.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T13:10:10.000Z",
      "valid_until": "2026-06-01T13:10:08.000Z"
    }
  ],
  "spec_version": "2.1",
  "type": "bundle",
  "x_nadsec_enrichment": {
    "enriched_at": "2026-04-30T23:45:56.979253+00:00",
    "sensor": "suricata",
    "sensor_type": "network_ids",
    "month": "2026-04",
    "ip_count": 104,
    "total_alerts": 2429
  },
  "x_nadsec_ip_context": {
    "94.102.49.51": {
      "alert_count": 1546,
      "first_seen": "2026-04-23T20:44:32.145Z",
      "last_seen": "2026-04-30T23:22:35.287Z",
      "signatures": [
        "SURICATA STREAM spurious retransmission",
        "SURICATA STREAM Packet with broken ack",
        "ET REMOTE_ACCESS Tunneled RDP msts Handshake"
      ],
      "categories": [
        "Generic Protocol Command Decode",
        "Potentially Bad Traffic"
      ],
      "severities": [
        3,
        2
      ],
      "dest_ports": [
        14956,
        2581,
        20132,
        30068,
        45246,
        1963,
        2603,
        2737,
        4588,
        5083
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 202425,
      "as_org": "IP Volume inc",
      "threat_score": 66.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 6.7,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 2540,
        "days_active_30d": 8,
        "ports_targeted_30d": 236,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T20:43:26+00:00",
        "last_seen_30d": "2026-04-30T23:22:35.287000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1546,
        "Honeytrap": 994
      }
    },
    "184.105.247.244": {
      "alert_count": 47,
      "first_seen": "2026-04-01T01:16:13.986Z",
      "last_seen": "2026-04-30T09:22:56.416Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        23,
        2123,
        3389,
        8873,
        9060,
        21,
        82,
        89,
        102,
        111
      ],
      "protocols": [
        "TCP",
        "UDP",
        "IP-in-IP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 66.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 47,
        "days_active_30d": 30,
        "ports_targeted_30d": 40,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-04-01T01:16:13.986000+00:00",
        "last_seen_30d": "2026-04-30T09:22:56.416000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 47
      }
    },
    "45.59.33.109": {
      "alert_count": 45,
      "first_seen": "2026-04-16T01:36:00.144Z",
      "last_seen": "2026-04-20T03:44:57.877Z",
      "signatures": [
        "ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        55555
      ],
      "protocols": [
        "TCP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Cincinnati",
      "asn": 6181,
      "as_org": "Cincinnati Bell Telephone Company LLC",
      "threat_score": 22.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.7,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 59,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T01:35:59+00:00",
        "last_seen_30d": "2026-04-20T03:44:57.877000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 45,
        "Honeytrap": 14
      }
    },
    "1.34.85.243": {
      "alert_count": 32,
      "first_seen": "2026-04-04T15:15:25.908Z",
      "last_seen": "2026-04-20T22:10:39.186Z",
      "signatures": [
        "ET EXPLOIT Possible VXWORKS Urgent11 RCE Attempt - Illegal Urgent Flag",
        "ET EXPLOIT Possible VXWORKS Urgent11 RCE Attempt - Urgent Flag",
        "SURICATA STREAM RST recv but no session"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Generic Protocol Command Decode"
      ],
      "severities": [
        1,
        3
      ],
      "dest_ports": [
        18866,
        19801,
        25844,
        28595,
        31360,
        36025,
        38472,
        43317
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "New Taipei City",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 33.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.1,
        "persistence": 14.2,
        "diversity": 16,
        "spread": 5,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 32,
        "days_active_30d": 17,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-04-04T15:15:25.908000+00:00",
        "last_seen_30d": "2026-04-20T22:10:39.186000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 32
      }
    },
    "202.112.237.233": {
      "alert_count": 28,
      "first_seen": "2026-04-01T22:34:05.249Z",
      "last_seen": "2026-04-26T16:58:05.648Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        80,
        22,
        53,
        443
      ],
      "protocols": [
        "TCP",
        "IP-in-IP",
        "ICMP"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4538,
      "as_org": "China Education and Research Network Center",
      "threat_score": 42.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.5,
        "persistence": 21.7,
        "diversity": 8,
        "spread": 5,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 26,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-04-01T22:34:05.249000+00:00",
        "last_seen_30d": "2026-04-26T16:58:05.648000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 28
      }
    },
    "65.49.1.141": {
      "alert_count": 26,
      "first_seen": "2026-04-02T12:07:33.218Z",
      "last_seen": "2026-04-28T14:58:31.165Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        9200,
        4443,
        8015,
        80,
        86,
        1098,
        2000,
        4002,
        4081,
        5001
      ],
      "protocols": [
        "TCP",
        "IP-in-IP",
        "UDP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 72.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.1,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 32,
        "days_active_30d": 27,
        "ports_targeted_30d": 19,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-02T12:07:33.218000+00:00",
        "last_seen_30d": "2026-04-28T14:58:31.165000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 26,
        "Honeytrap": 3,
        "ElasticPot": 2,
        "CitrixHoneypot": 1
      }
    },
    "65.49.1.214": {
      "alert_count": 26,
      "first_seen": "2026-04-06T03:18:40.390Z",
      "last_seen": "2026-04-28T12:15:39.701Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        443,
        500,
        9200,
        82,
        548,
        1337,
        1723,
        2323,
        5678,
        5905
      ],
      "protocols": [
        "TCP",
        "IP-in-IP",
        "UDP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 64.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.5,
        "persistence": 19.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 23,
        "ports_targeted_30d": 19,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-06T03:18:40.390000+00:00",
        "last_seen_30d": "2026-04-28T12:15:39.701000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 26,
        "ElasticPot": 1,
        "Honeytrap": 1
      }
    },
    "64.62.156.193": {
      "alert_count": 25,
      "first_seen": "2026-04-02T14:20:11.771Z",
      "last_seen": "2026-04-30T05:49:54.033Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        9200,
        4433,
        23556,
        87,
        135,
        212,
        444,
        2375,
        4080,
        4646
      ],
      "protocols": [
        "TCP",
        "IP-in-IP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 68.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.8,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 29,
        "ports_targeted_30d": 19,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T14:20:11.771000+00:00",
        "last_seen_30d": "2026-04-30T05:49:54.033000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 25,
        "Honeytrap": 5
      }
    },
    "65.49.1.196": {
      "alert_count": 24,
      "first_seen": "2026-04-01T08:11:13.594Z",
      "last_seen": "2026-04-27T05:41:29.335Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free",
        "ET INFO SSH session in progress on Expected Port"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Misc activity"
      ],
      "severities": [
        1,
        3
      ],
      "dest_ports": [
        22,
        443,
        3000,
        84,
        179,
        2000,
        5432,
        8040,
        9001,
        18245
      ],
      "protocols": [
        "TCP",
        "IP-in-IP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 69.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.9,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 27,
        "ports_targeted_30d": 15,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-04-01T08:11:13.594000+00:00",
        "last_seen_30d": "2026-04-27T05:41:29.335000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 24,
        "Cowrie": 4,
        "Honeytrap": 2,
        "Honeyaml": 1
      }
    },
    "184.105.139.119": {
      "alert_count": 22,
      "first_seen": "2026-04-05T03:27:31.149Z",
      "last_seen": "2026-04-28T00:53:00.660Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free",
        "ET INFO SSH session in progress on Unusual Port"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Misc activity"
      ],
      "severities": [
        1,
        3
      ],
      "dest_ports": [
        22122,
        500,
        80,
        993,
        2031,
        2121,
        2600,
        3389,
        4002,
        4433
      ],
      "protocols": [
        "TCP",
        "UDP",
        "IP-in-IP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 59.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.6,
        "persistence": 20.0,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 24,
        "ports_targeted_30d": 17,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-05T03:27:31.149000+00:00",
        "last_seen_30d": "2026-04-28T00:53:00.660000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 22,
        "Honeytrap": 1
      }
    },
    "64.62.197.94": {
      "alert_count": 21,
      "first_seen": "2026-04-01T04:37:47.598Z",
      "last_seen": "2026-04-30T15:47:54.504Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free",
        "ET INFO SSH session in progress on Unusual Port"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Misc activity"
      ],
      "severities": [
        1,
        3
      ],
      "dest_ports": [
        22522,
        37,
        135,
        523,
        1911,
        5432,
        6080,
        7047,
        8001,
        8010
      ],
      "protocols": [
        "TCP",
        "IP-in-IP",
        "UDP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 69.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 26,
        "days_active_30d": 30,
        "ports_targeted_30d": 17,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T04:37:47.598000+00:00",
        "last_seen_30d": "2026-04-30T15:47:54.504000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 21,
        "Honeytrap": 5
      }
    },
    "65.49.1.112": {
      "alert_count": 19,
      "first_seen": "2026-04-02T07:00:48.780Z",
      "last_seen": "2026-04-28T11:30:27.254Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        3389,
        11,
        19,
        23,
        37,
        82,
        2152,
        3128,
        4433,
        4573
      ],
      "protocols": [
        "TCP",
        "UDP",
        "IP-in-IP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 61.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 13.8,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 27,
        "ports_targeted_30d": 16,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T07:00:48.780000+00:00",
        "last_seen_30d": "2026-04-28T11:30:27.254000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 19,
        "Honeytrap": 5
      }
    },
    "65.49.20.100": {
      "alert_count": 18,
      "first_seen": "2026-04-04T01:40:11.248Z",
      "last_seen": "2026-04-24T14:01:19.269Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        161,
        443,
        135,
        2002,
        4080,
        5081,
        6516,
        7047,
        8030,
        9200
      ],
      "protocols": [
        "TCP",
        "IP-in-IP",
        "UDP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 48.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.0,
        "persistence": 17.5,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 21,
        "ports_targeted_30d": 14,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T01:40:11.248000+00:00",
        "last_seen_30d": "2026-04-24T14:01:19.269000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 18,
        "Honeytrap": 2
      }
    },
    "184.105.247.248": {
      "alert_count": 17,
      "first_seen": "2026-04-02T05:33:15.482Z",
      "last_seen": "2026-04-30T01:44:15.846Z",
      "signatures": [
        "ET INFO SSH session in progress on Unusual Port",
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"
      ],
      "categories": [
        "Misc activity",
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        3,
        1
      ],
      "dest_ports": [
        22122,
        53282,
        25,
        90,
        2083,
        3000,
        3389,
        5000,
        6025,
        8060
      ],
      "protocols": [
        "TCP",
        "IP-in-IP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 67.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 13.0,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 29,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T05:33:15.482000+00:00",
        "last_seen_30d": "2026-04-30T01:44:15.846000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 17,
        "Honeytrap": 3
      }
    },
    "64.62.156.133": {
      "alert_count": 17,
      "first_seen": "2026-04-02T01:39:32.375Z",
      "last_seen": "2026-04-24T02:53:14.549Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free",
        "ET INFO SSH session in progress on Unusual Port"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Misc activity"
      ],
      "severities": [
        1,
        3
      ],
      "dest_ports": [
        1337,
        8443,
        541,
        2001,
        6001,
        8060,
        9192,
        12546,
        12746,
        23456
      ],
      "protocols": [
        "TCP",
        "IP-in-IP",
        "UDP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 53.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.8,
        "persistence": 19.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 23,
        "ports_targeted_30d": 12,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-02T01:39:32.375000+00:00",
        "last_seen_30d": "2026-04-24T02:53:14.549000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 17,
        "Ciscoasa": 1,
        "Honeytrap": 1
      }
    },
    "184.105.247.214": {
      "alert_count": 16,
      "first_seen": "2026-04-02T08:59:53.188Z",
      "last_seen": "2026-04-29T03:24:48.554Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        13,
        25,
        143,
        2031,
        2096,
        3000,
        4002,
        4080,
        8001,
        9001
      ],
      "protocols": [
        "TCP",
        "IP-in-IP",
        "UDP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 58.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.0,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 28,
        "ports_targeted_30d": 14,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-04-02T08:59:53.188000+00:00",
        "last_seen_30d": "2026-04-29T03:24:48.554000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 16
      }
    },
    "64.62.156.149": {
      "alert_count": 16,
      "first_seen": "2026-04-02T10:20:24.383Z",
      "last_seen": "2026-04-30T01:09:10.819Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        4443,
        5986,
        135,
        801,
        2031,
        4080,
        4081,
        5432,
        6516,
        8000
      ],
      "protocols": [
        "TCP",
        "IP-in-IP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 72.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 13.0,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 29,
        "ports_targeted_30d": 13,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-02T10:20:24.383000+00:00",
        "last_seen_30d": "2026-04-30T01:09:10.819000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 16,
        "Honeytrap": 3,
        "CitrixHoneypot": 1
      }
    },
    "64.62.197.99": {
      "alert_count": 15,
      "first_seen": "2026-04-01T04:08:59.121Z",
      "last_seen": "2026-04-30T06:26:07.968Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        37,
        86,
        179,
        389,
        3001,
        5081,
        8888,
        9100,
        9200,
        9643
      ],
      "protocols": [
        "TCP",
        "UDP",
        "IP-in-IP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 67.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 12.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 30,
        "ports_targeted_30d": 13,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T04:08:59.121000+00:00",
        "last_seen_30d": "2026-04-30T06:26:07.968000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 15,
        "Honeytrap": 1
      }
    },
    "65.49.1.127": {
      "alert_count": 15,
      "first_seen": "2026-04-01T07:53:48.572Z",
      "last_seen": "2026-04-26T08:12:05.016Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        80,
        22,
        2031,
        2083,
        3001,
        6081,
        6443,
        8001,
        8020,
        8888
      ],
      "protocols": [
        "TCP",
        "IP-in-IP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 60.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 13.0,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 26,
        "ports_targeted_30d": 12,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-01T07:53:48.572000+00:00",
        "last_seen_30d": "2026-04-26T08:12:05.016000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 15,
        "Honeytrap": 4,
        "Tanner": 1
      }
    },
    "65.49.20.111": {
      "alert_count": 15,
      "first_seen": "2026-04-03T05:51:50.522Z",
      "last_seen": "2026-04-30T11:28:18.211Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        427,
        2096,
        3333,
        5081,
        5988,
        6081,
        8050,
        11453,
        14443,
        17017
      ],
      "protocols": [
        "TCP",
        "IP-in-IP",
        "UDP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 60.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 11.8,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 28,
        "ports_targeted_30d": 13,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-04-03T05:51:50.522000+00:00",
        "last_seen_30d": "2026-04-30T11:28:18.211000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 15
      }
    },
    "184.105.139.109": {
      "alert_count": 14,
      "first_seen": "2026-04-01T01:05:33.029Z",
      "last_seen": "2026-04-30T12:01:27.788Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        443,
        90,
        2001,
        4081,
        4443,
        5986,
        8015,
        11453,
        23956,
        47808
      ],
      "protocols": [
        "TCP",
        "IP-in-IP",
        "UDP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 66.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 11.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 30,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T01:05:33.029000+00:00",
        "last_seen_30d": "2026-04-30T12:01:27.788000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 14,
        "Honeytrap": 1
      }
    },
    "64.62.197.55": {
      "alert_count": 14,
      "first_seen": "2026-04-03T13:45:42.019Z",
      "last_seen": "2026-04-26T14:27:52.337Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        443,
        500,
        1080,
        3306,
        3389,
        4001,
        9990,
        20020,
        23956,
        60000
      ],
      "protocols": [
        "TCP",
        "UDP",
        "IP-in-IP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 58.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.0,
        "persistence": 20.0,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 24,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-04-03T13:45:42.019000+00:00",
        "last_seen_30d": "2026-04-26T14:27:52.337000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 14,
        "H0neytr4p": 1,
        "Honeytrap": 1
      }
    },
    "64.62.197.8": {
      "alert_count": 13,
      "first_seen": "2026-04-01T07:06:02.061Z",
      "last_seen": "2026-04-29T07:10:03.632Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        23656,
        23,
        403,
        3389,
        5802,
        6000,
        11443,
        12443,
        13443,
        18789
      ],
      "protocols": [
        "TCP",
        "IP-in-IP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 63.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 11.8,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 29,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-01T07:05:41+00:00",
        "last_seen_30d": "2026-04-29T07:10:03.632000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 13,
        "Honeytrap": 2
      }
    },
    "64.62.197.169": {
      "alert_count": 12,
      "first_seen": "2026-04-03T08:19:33.707Z",
      "last_seen": "2026-04-28T13:07:06.332Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        53,
        1962,
        3306,
        3389,
        4080,
        4434,
        7900,
        8060,
        9090,
        24056
      ],
      "protocols": [
        "TCP",
        "IP-in-IP",
        "UDP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 58.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 11.5,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 26,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T08:19:33.707000+00:00",
        "last_seen_30d": "2026-04-28T13:07:06.332000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 12,
        "Honeytrap": 2
      }
    },
    "23.240.197.167": {
      "alert_count": 11,
      "first_seen": "2026-04-07T04:40:34.576Z",
      "last_seen": "2026-04-30T19:22:42.375Z",
      "signatures": [
        "ET EXPLOIT Possible Authenticated Command Injection Inbound - Comtrend VR-3033 (CVE-2020-10173)",
        "SURICATA HTTP missing Host header"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Generic Protocol Command Decode"
      ],
      "severities": [
        1,
        3
      ],
      "dest_ports": [
        80,
        5555
      ],
      "protocols": [
        "TCP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Oxnard",
      "asn": 20001,
      "as_org": "Charter Communications Inc",
      "threat_score": 44.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 10.8,
        "persistence": 20.0,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 24,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-07T04:40:34.576000+00:00",
        "last_seen_30d": "2026-04-30T19:22:42.375000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Adbhoney": 1
      }
    },
    "114.33.222.169": {
      "alert_count": 10,
      "first_seen": "2026-04-15T03:34:49.649Z",
      "last_seen": "2026-04-18T13:42:35.581Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        7547
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Kaohsiung",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-15T03:34:49+00:00",
        "last_seen_30d": "2026-04-18T13:42:35.581000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Suricata": 10,
        "Honeytrap": 2
      }
    },
    "65.49.1.47": {
      "alert_count": 10,
      "first_seen": "2026-04-03T01:59:41.714Z",
      "last_seen": "2026-04-24T11:51:58.602Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        808,
        811,
        4573,
        8123,
        9643,
        20443,
        23856,
        65422
      ],
      "protocols": [
        "TCP",
        "IP-in-IP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 44.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 11.1,
        "persistence": 18.3,
        "diversity": 16,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 22,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T01:58:34+00:00",
        "last_seen_30d": "2026-04-24T11:51:58.602000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 10,
        "Honeytrap": 3
      }
    },
    "107.205.30.254": {
      "alert_count": 9,
      "first_seen": "2026-04-20T11:03:57.296Z",
      "last_seen": "2026-04-20T11:05:06.810Z",
      "signatures": [
        "ET EXPLOIT Possible Authenticated Command Injection Inbound - Comtrend VR-3033 (CVE-2020-10173)",
        "SURICATA HTTP missing Host header"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Generic Protocol Command Decode"
      ],
      "severities": [
        1,
        3
      ],
      "dest_ports": [
        80
      ],
      "protocols": [
        "TCP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Marietta",
      "asn": 7018,
      "as_org": "AT&T Enterprises, LLC",
      "threat_score": 11.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-04-20T11:03:57.296000+00:00",
        "last_seen_30d": "2026-04-20T11:05:06.810000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9
      }
    },
    "64.62.156.141": {
      "alert_count": 9,
      "first_seen": "2026-04-02T13:20:24.684Z",
      "last_seen": "2026-04-28T02:10:14.010Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        443,
        2031,
        4002,
        4573,
        8040,
        53282
      ],
      "protocols": [
        "TCP",
        "IP-in-IP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 50.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 10.0,
        "persistence": 22.5,
        "diversity": 12,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 27,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T13:20:24.684000+00:00",
        "last_seen_30d": "2026-04-28T02:10:14.010000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Honeytrap": 1
      }
    },
    "74.82.47.28": {
      "alert_count": 9,
      "first_seen": "2026-04-03T12:25:42.492Z",
      "last_seen": "2026-04-24T10:52:15.465Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        110,
        1911,
        2031,
        5800,
        12654,
        13443,
        22222
      ],
      "protocols": [
        "TCP",
        "IP-in-IP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Gunnison",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 41.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 10.0,
        "persistence": 18.3,
        "diversity": 14,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 22,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T12:25:42.492000+00:00",
        "last_seen_30d": "2026-04-24T10:52:15.465000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Honeytrap": 1
      }
    },
    "102.129.152.194": {
      "alert_count": 8,
      "first_seen": "2026-04-30T04:35:30.266Z",
      "last_seen": "2026-04-30T04:36:40.613Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11910 anomalous ICMPv4 type 3,code 4 Path MTU Discovery",
        "SURICATA STREAM Packet with invalid timestamp"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Generic Protocol Command Decode"
      ],
      "severities": [
        1,
        3
      ],
      "dest_ports": [
        80
      ],
      "protocols": [
        "ICMP",
        "TCP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 174,
      "as_org": "Cogent Communications, LLC",
      "threat_score": 22.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-30T04:35:29.914000+00:00",
        "last_seen_30d": "2026-04-30T04:36:40.613000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Tanner": 1
      }
    },
    "218.97.90.125": {
      "alert_count": 8,
      "first_seen": "2026-04-04T08:37:09.127Z",
      "last_seen": "2026-04-19T22:02:43.191Z",
      "signatures": [
        "GPL SCAN loopback traffic"
      ],
      "categories": [
        "Potentially Bad Traffic"
      ],
      "severities": [
        2
      ],
      "dest_ports": [
        7682,
        8875,
        11534,
        15018,
        21101,
        44500,
        51268
      ],
      "protocols": [
        "UDP"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 10212,
      "as_org": "China Enterprise ICT Solutions Limited",
      "threat_score": 26.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 13.3,
        "diversity": 14,
        "spread": 5,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 16,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-04-04T08:37:09.127000+00:00",
        "last_seen_30d": "2026-04-19T22:02:43.191000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8
      }
    },
    "185.35.147.27": {
      "alert_count": 7,
      "first_seen": "2026-04-18T15:36:41.532Z",
      "last_seen": "2026-04-18T15:36:41.532Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11910 anomalous ICMPv4 type 3,code 4 Path MTU Discovery"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [],
      "protocols": [
        "ICMP"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 200187,
      "as_org": "CloudKleyer Frankfurt GmbH",
      "threat_score": 8.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 0,
        "spread": 5,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 0,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-04-18T15:36:41.532000+00:00",
        "last_seen_30d": "2026-04-18T15:36:41.532000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7
      }
    },
    "1.40.204.69": {
      "alert_count": 6,
      "first_seen": "2026-04-12T13:37:56.019Z",
      "last_seen": "2026-04-12T20:27:26.371Z",
      "signatures": [
        "ET EXPLOIT Possible Authenticated Command Injection Inbound - Comtrend VR-3033 (CVE-2020-10173)",
        "SURICATA HTTP missing Host header"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Generic Protocol Command Decode"
      ],
      "severities": [
        1,
        3
      ],
      "dest_ports": [
        80
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 4804,
      "as_org": "Microplex PTY LTD",
      "threat_score": 6.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-04-12T13:37:56.019000+00:00",
        "last_seen_30d": "2026-04-12T20:27:26.371000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6
      }
    },
    "105.99.123.73": {
      "alert_count": 6,
      "first_seen": "2026-04-06T05:05:10.519Z",
      "last_seen": "2026-04-06T05:06:35.757Z",
      "signatures": [
        "ET EXPLOIT Possible Authenticated Command Injection Inbound - Comtrend VR-3033 (CVE-2020-10173)",
        "SURICATA HTTP missing Host header"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Generic Protocol Command Decode"
      ],
      "severities": [
        1,
        3
      ],
      "dest_ports": [
        80
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Algeria",
      "country_code": "DZ",
      "city": "Algiers",
      "asn": 36947,
      "as_org": "Telecom Algeria",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-04-06T05:05:10.519000+00:00",
        "last_seen_30d": "2026-04-06T05:06:35.757000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6
      }
    },
    "175.107.221.4": {
      "alert_count": 6,
      "first_seen": "2026-04-19T14:47:41.118Z",
      "last_seen": "2026-04-19T14:47:41.119Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)",
        "SURICATA HTTP Unexpected Request body"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Generic Protocol Command Decode"
      ],
      "severities": [
        1,
        3
      ],
      "dest_ports": [
        49152
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T14:46:35+00:00",
        "last_seen_30d": "2026-04-19T14:47:41.119000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Honeytrap": 1
      }
    },
    "72.255.18.116": {
      "alert_count": 6,
      "first_seen": "2026-04-20T19:24:07.763Z",
      "last_seen": "2026-04-22T07:49:26.073Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)",
        "SURICATA HTTP Unexpected Request body"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Generic Protocol Command Decode"
      ],
      "severities": [
        1,
        3
      ],
      "dest_ports": [
        49152,
        23
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 18.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 2.5,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 3,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-20T19:24:06+00:00",
        "last_seen_30d": "2026-04-22T07:49:26.073000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Honeytrap": 1
      }
    },
    "102.219.27.166": {
      "alert_count": 5,
      "first_seen": "2026-04-10T16:08:36.256Z",
      "last_seen": "2026-04-10T16:09:42.049Z",
      "signatures": [
        "ET EXPLOIT Possible Authenticated Command Injection Inbound - Comtrend VR-3033 (CVE-2020-10173)",
        "SURICATA HTTP missing Host header"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Generic Protocol Command Decode"
      ],
      "severities": [
        1,
        3
      ],
      "dest_ports": [
        80
      ],
      "protocols": [
        "TCP"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Johannesburg",
      "asn": 11845,
      "as_org": "Vox-Telecom",
      "threat_score": 4.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-04-10T16:08:36.256000+00:00",
        "last_seen_30d": "2026-04-10T16:09:42.049000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5
      }
    },
    "103.176.16.109": {
      "alert_count": 5,
      "first_seen": "2026-04-30T10:06:15.801Z",
      "last_seen": "2026-04-30T10:07:24.930Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        8080
      ],
      "protocols": [
        "TCP"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Delhi",
      "asn": 135687,
      "as_org": "Qwistel Network Service Private Limited",
      "threat_score": 14.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-04-30T10:06:15.801000+00:00",
        "last_seen_30d": "2026-04-30T10:07:24.930000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5
      }
    },
    "103.181.160.4": {
      "alert_count": 5,
      "first_seen": "2026-04-15T12:39:59.892Z",
      "last_seen": "2026-04-15T12:41:10.534Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        8080
      ],
      "protocols": [
        "TCP"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "New Delhi",
      "asn": 138245,
      "as_org": "Xpress Net Solution",
      "threat_score": 7.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-04-15T12:39:59.892000+00:00",
        "last_seen_30d": "2026-04-15T12:41:10.534000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5
      }
    },
    "103.93.93.182": {
      "alert_count": 5,
      "first_seen": "2026-04-04T08:34:20.437Z",
      "last_seen": "2026-04-04T08:44:21.197Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)",
        "SURICATA HTTP Unexpected Request body"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Generic Protocol Command Decode"
      ],
      "severities": [
        1,
        3
      ],
      "dest_ports": [
        49152
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 141140,
      "as_org": "PT Jinde Grup Indonesia",
      "threat_score": 2.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-04T08:34:18+00:00",
        "last_seen_30d": "2026-04-04T08:44:21.197000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Honeytrap": 1
      }
    },
    "104.28.164.135": {
      "alert_count": 5,
      "first_seen": "2026-04-19T14:19:10.349Z",
      "last_seen": "2026-04-19T14:20:14.901Z",
      "signatures": [
        "ET INFO Cleartext WordPress Login"
      ],
      "categories": [
        "Potential Corporate Privacy Violation"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        8080
      ],
      "protocols": [
        "TCP"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Hounslow",
      "asn": 13335,
      "as_org": "Cloudflare, Inc.",
      "threat_score": 14.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T14:19:10.067000+00:00",
        "last_seen_30d": "2026-04-19T14:20:14.901000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Wordpot": 1
      }
    },
    "107.4.24.4": {
      "alert_count": 5,
      "first_seen": "2026-04-04T07:18:45.047Z",
      "last_seen": "2026-04-04T07:19:49.905Z",
      "signatures": [
        "ET EXPLOIT Possible Authenticated Command Injection Inbound - Comtrend VR-3033 (CVE-2020-10173)",
        "SURICATA HTTP missing Host header"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Generic Protocol Command Decode"
      ],
      "severities": [
        1,
        3
      ],
      "dest_ports": [
        80
      ],
      "protocols": [
        "TCP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Jackson",
      "asn": 7922,
      "as_org": "Comcast Cable Communications, LLC",
      "threat_score": 2.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-04-04T07:18:45.047000+00:00",
        "last_seen_30d": "2026-04-04T07:19:49.905000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5
      }
    },
    "115.58.133.187": {
      "alert_count": 5,
      "first_seen": "2026-04-01T04:18:15.687Z",
      "last_seen": "2026-04-01T04:19:17.308Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        8080
      ],
      "protocols": [
        "TCP"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 1.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-04-01T04:18:15.687000+00:00",
        "last_seen_30d": "2026-04-01T04:19:17.308000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5
      }
    },
    "120.85.118.116": {
      "alert_count": 5,
      "first_seen": "2026-04-23T21:47:36.863Z",
      "last_seen": "2026-04-23T21:48:54.956Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)",
        "SURICATA HTTP Unexpected Request body"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Generic Protocol Command Decode"
      ],
      "severities": [
        1,
        3
      ],
      "dest_ports": [
        49152
      ],
      "protocols": [
        "TCP"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 17622,
      "as_org": "China Unicom Guangzhou network",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-23T21:47:35+00:00",
        "last_seen_30d": "2026-04-23T21:48:54.956000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Honeytrap": 1
      }
    },
    "148.135.1.82": {
      "alert_count": 5,
      "first_seen": "2026-04-08T20:33:04.228Z",
      "last_seen": "2026-04-08T20:33:04.228Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11910 anomalous ICMPv4 type 3,code 4 Path MTU Discovery"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [],
      "protocols": [
        "ICMP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 35916,
      "as_org": "MULTACOM CORPORATION",
      "threat_score": 3.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 0,
        "spread": 5,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 0,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-04-08T20:33:04.228000+00:00",
        "last_seen_30d": "2026-04-08T20:33:04.228000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5
      }
    },
    "148.222.129.209": {
      "alert_count": 5,
      "first_seen": "2026-04-06T03:40:27.219Z",
      "last_seen": "2026-04-06T03:41:31.935Z",
      "signatures": [
        "ET EXPLOIT Possible Authenticated Command Injection Inbound - Comtrend VR-3033 (CVE-2020-10173)",
        "SURICATA HTTP missing Host header"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Generic Protocol Command Decode"
      ],
      "severities": [
        1,
        3
      ],
      "dest_ports": [
        80
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Paraguay",
      "country_code": "PY",
      "city": "Asunci\u00f3n",
      "asn": 14593,
      "as_org": "Space Exploration Technologies Corporation",
      "threat_score": 3.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-04-06T03:40:27.219000+00:00",
        "last_seen_30d": "2026-04-06T03:41:31.935000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5
      }
    },
    "157.100.58.35": {
      "alert_count": 5,
      "first_seen": "2026-04-08T19:34:58.868Z",
      "last_seen": "2026-04-08T19:36:06.975Z",
      "signatures": [
        "ET EXPLOIT Possible Authenticated Command Injection Inbound - Comtrend VR-3033 (CVE-2020-10173)",
        "SURICATA HTTP missing Host header"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Generic Protocol Command Decode"
      ],
      "severities": [
        1,
        3
      ],
      "dest_ports": [
        80
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Ecuador",
      "country_code": "EC",
      "city": "Quito",
      "asn": 52468,
      "as_org": "UFINET PANAMA S.A.",
      "threat_score": 4.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-04-08T19:34:58.868000+00:00",
        "last_seen_30d": "2026-04-08T19:36:06.975000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5
      }
    },
    "172.59.35.70": {
      "alert_count": 5,
      "first_seen": "2026-04-19T17:52:10.658Z",
      "last_seen": "2026-04-19T17:53:19.732Z",
      "signatures": [
        "ET EXPLOIT Possible Authenticated Command Injection Inbound - Comtrend VR-3033 (CVE-2020-10173)",
        "SURICATA HTTP missing Host header"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Generic Protocol Command Decode"
      ],
      "severities": [
        1,
        3
      ],
      "dest_ports": [
        80
      ],
      "protocols": [
        "TCP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Cincinnati",
      "asn": 21928,
      "as_org": "T-Mobile USA, Inc.",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-04-19T17:52:10.658000+00:00",
        "last_seen_30d": "2026-04-19T17:53:19.732000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5
      }
    },
    "175.107.208.22": {
      "alert_count": 5,
      "first_seen": "2026-04-03T18:01:12.799Z",
      "last_seen": "2026-04-03T18:02:27.318Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)",
        "SURICATA HTTP Unexpected Request body"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Generic Protocol Command Decode"
      ],
      "severities": [
        1,
        3
      ],
      "dest_ports": [
        49152
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 2.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T18:01:10+00:00",
        "last_seen_30d": "2026-04-03T18:02:27.318000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Honeytrap": 1
      }
    },
    "176.235.182.142": {
      "alert_count": 5,
      "first_seen": "2026-04-02T17:43:53.052Z",
      "last_seen": "2026-04-02T17:45:01.884Z",
      "signatures": [
        "ET EXPLOIT Possible Authenticated Command Injection Inbound - Comtrend VR-3033 (CVE-2020-10173)",
        "SURICATA HTTP missing Host header"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Generic Protocol Command Decode"
      ],
      "severities": [
        1,
        3
      ],
      "dest_ports": [
        80
      ],
      "protocols": [
        "TCP"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Kilis",
      "asn": 34984,
      "as_org": "Superonline Iletisim Hizmetleri A.S.",
      "threat_score": 1.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-04-02T17:43:53.052000+00:00",
        "last_seen_30d": "2026-04-02T17:45:01.884000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5
      }
    },
    "182.127.190.40": {
      "alert_count": 5,
      "first_seen": "2026-04-02T21:52:43.745Z",
      "last_seen": "2026-04-02T21:53:47.545Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        8080
      ],
      "protocols": [
        "TCP"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 1.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-04-02T21:52:43.745000+00:00",
        "last_seen_30d": "2026-04-02T21:53:47.545000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5
      }
    },
    "186.209.190.84": {
      "alert_count": 5,
      "first_seen": "2026-04-02T20:22:29.216Z",
      "last_seen": "2026-04-02T20:23:34.006Z",
      "signatures": [
        "ET EXPLOIT Possible Authenticated Command Injection Inbound - Comtrend VR-3033 (CVE-2020-10173)",
        "SURICATA HTTP missing Host header"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Generic Protocol Command Decode"
      ],
      "severities": [
        1,
        3
      ],
      "dest_ports": [
        80
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Bras\u00edlia",
      "asn": 28227,
      "as_org": "NOVACIA TECNOLOGIA E TELECOMUNICACOES LTDA",
      "threat_score": 1.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-04-02T20:22:29.216000+00:00",
        "last_seen_30d": "2026-04-02T20:23:34.006000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5
      }
    },
    "186.235.99.19": {
      "alert_count": 5,
      "first_seen": "2026-04-10T07:42:35.582Z",
      "last_seen": "2026-04-10T07:43:44.398Z",
      "signatures": [
        "ET EXPLOIT Possible Authenticated Command Injection Inbound - Comtrend VR-3033 (CVE-2020-10173)",
        "SURICATA HTTP missing Host header"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Generic Protocol Command Decode"
      ],
      "severities": [
        1,
        3
      ],
      "dest_ports": [
        80
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Juiz de Fora",
      "asn": 28258,
      "as_org": "VERO S.A",
      "threat_score": 4.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-04-10T07:42:35.582000+00:00",
        "last_seen_30d": "2026-04-10T07:43:44.398000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5
      }
    },
    "24.9.196.5": {
      "alert_count": 5,
      "first_seen": "2026-04-14T15:16:04.033Z",
      "last_seen": "2026-04-14T15:17:10.695Z",
      "signatures": [
        "ET EXPLOIT Possible Authenticated Command Injection Inbound - Comtrend VR-3033 (CVE-2020-10173)",
        "SURICATA HTTP missing Host header"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Generic Protocol Command Decode"
      ],
      "severities": [
        1,
        3
      ],
      "dest_ports": [
        80
      ],
      "protocols": [
        "TCP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Fort Collins",
      "asn": 7922,
      "as_org": "Comcast Cable Communications, LLC",
      "threat_score": 6.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-04-14T15:16:04.033000+00:00",
        "last_seen_30d": "2026-04-14T15:17:10.695000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5
      }
    },
    "24.95.137.46": {
      "alert_count": 5,
      "first_seen": "2026-04-10T03:26:08.065Z",
      "last_seen": "2026-04-10T03:27:14.046Z",
      "signatures": [
        "ET EXPLOIT Possible Authenticated Command Injection Inbound - Comtrend VR-3033 (CVE-2020-10173)",
        "SURICATA HTTP missing Host header"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Generic Protocol Command Decode"
      ],
      "severities": [
        1,
        3
      ],
      "dest_ports": [
        80
      ],
      "protocols": [
        "TCP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Marion",
      "asn": 10796,
      "as_org": "Charter Communications Inc",
      "threat_score": 4.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-04-10T03:26:08.065000+00:00",
        "last_seen_30d": "2026-04-10T03:27:14.046000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5
      }
    },
    "5.172.22.97": {
      "alert_count": 5,
      "first_seen": "2026-04-22T06:20:09.034Z",
      "last_seen": "2026-04-22T06:21:21.875Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)",
        "SURICATA HTTP Unexpected Request body"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Generic Protocol Command Decode"
      ],
      "severities": [
        1,
        3
      ],
      "dest_ports": [
        49152
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 28890,
      "as_org": "INSYS LLC",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-22T06:20:07+00:00",
        "last_seen_30d": "2026-04-22T06:21:21.875000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Honeytrap": 1
      }
    },
    "5.38.0.213": {
      "alert_count": 5,
      "first_seen": "2026-04-03T22:22:51.769Z",
      "last_seen": "2026-04-03T22:24:00.148Z",
      "signatures": [
        "ET EXPLOIT Possible Authenticated Command Injection Inbound - Comtrend VR-3033 (CVE-2020-10173)",
        "SURICATA HTTP missing Host header"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Generic Protocol Command Decode"
      ],
      "severities": [
        1,
        3
      ],
      "dest_ports": [
        80
      ],
      "protocols": [
        "TCP"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": "Sharjah",
      "asn": 5384,
      "as_org": "Emirates Telecommunications Group Company (etisalat Group) Pjsc",
      "threat_score": 1.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-04-03T22:22:51.769000+00:00",
        "last_seen_30d": "2026-04-03T22:24:00.148000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5
      }
    },
    "68.40.127.49": {
      "alert_count": 5,
      "first_seen": "2026-04-06T10:09:53.723Z",
      "last_seen": "2026-04-06T10:10:59.100Z",
      "signatures": [
        "ET EXPLOIT Possible Authenticated Command Injection Inbound - Comtrend VR-3033 (CVE-2020-10173)",
        "SURICATA HTTP missing Host header"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Generic Protocol Command Decode"
      ],
      "severities": [
        1,
        3
      ],
      "dest_ports": [
        80
      ],
      "protocols": [
        "TCP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Lansing",
      "asn": 7922,
      "as_org": "Comcast Cable Communications, LLC",
      "threat_score": 3.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-04-06T10:09:53.723000+00:00",
        "last_seen_30d": "2026-04-06T10:10:59.100000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5
      }
    },
    "72.49.246.191": {
      "alert_count": 5,
      "first_seen": "2026-04-16T01:34:45.651Z",
      "last_seen": "2026-04-16T01:35:53.575Z",
      "signatures": [
        "ET EXPLOIT Possible Authenticated Command Injection Inbound - Comtrend VR-3033 (CVE-2020-10173)",
        "SURICATA HTTP missing Host header"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Generic Protocol Command Decode"
      ],
      "severities": [
        1,
        3
      ],
      "dest_ports": [
        80
      ],
      "protocols": [
        "TCP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Edgewood",
      "asn": 6181,
      "as_org": "Cincinnati Bell Telephone Company LLC",
      "threat_score": 7.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-04-16T01:34:45.651000+00:00",
        "last_seen_30d": "2026-04-16T01:35:53.575000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5
      }
    },
    "74.244.109.239": {
      "alert_count": 5,
      "first_seen": "2026-04-10T01:36:46.325Z",
      "last_seen": "2026-04-10T01:37:54.807Z",
      "signatures": [
        "ET EXPLOIT Possible Authenticated Command Injection Inbound - Comtrend VR-3033 (CVE-2020-10173)",
        "SURICATA HTTP missing Host header"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Generic Protocol Command Decode"
      ],
      "severities": [
        1,
        3
      ],
      "dest_ports": [
        80
      ],
      "protocols": [
        "TCP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Billings",
      "asn": 14593,
      "as_org": "Space Exploration Technologies Corporation",
      "threat_score": 4.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-04-10T01:36:46.325000+00:00",
        "last_seen_30d": "2026-04-10T01:37:54.807000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5
      }
    },
    "98.147.139.195": {
      "alert_count": 5,
      "first_seen": "2026-04-04T14:12:52.605Z",
      "last_seen": "2026-04-04T14:14:01.660Z",
      "signatures": [
        "ET EXPLOIT Possible Authenticated Command Injection Inbound - Comtrend VR-3033 (CVE-2020-10173)",
        "SURICATA HTTP missing Host header"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Generic Protocol Command Decode"
      ],
      "severities": [
        1,
        3
      ],
      "dest_ports": [
        80
      ],
      "protocols": [
        "TCP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Baldwin Park",
      "asn": 20001,
      "as_org": "Charter Communications Inc",
      "threat_score": 2.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-04-04T14:12:52.605000+00:00",
        "last_seen_30d": "2026-04-04T14:14:01.660000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5
      }
    },
    "98.97.37.18": {
      "alert_count": 5,
      "first_seen": "2026-04-29T23:54:20.472Z",
      "last_seen": "2026-04-29T23:55:23.257Z",
      "signatures": [
        "ET EXPLOIT Possible Authenticated Command Injection Inbound - Comtrend VR-3033 (CVE-2020-10173)",
        "SURICATA HTTP missing Host header"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Generic Protocol Command Decode"
      ],
      "severities": [
        1,
        3
      ],
      "dest_ports": [
        80
      ],
      "protocols": [
        "TCP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 14593,
      "as_org": "Space Exploration Technologies Corporation",
      "threat_score": 14.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-04-29T23:54:20.472000+00:00",
        "last_seen_30d": "2026-04-29T23:55:23.257000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5
      }
    },
    "103.160.197.223": {
      "alert_count": 4,
      "first_seen": "2026-04-22T22:04:16.993Z",
      "last_seen": "2026-04-22T22:05:20.659Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        80
      ],
      "protocols": [
        "TCP"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "H\u0101thras",
      "asn": 135761,
      "as_org": "Userlinks Netcom Pvt. Ltd.",
      "threat_score": 10.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-04-22T22:04:16.993000+00:00",
        "last_seen_30d": "2026-04-22T22:05:20.659000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4
      }
    },
    "103.38.53.17": {
      "alert_count": 4,
      "first_seen": "2026-04-11T19:13:17.495Z",
      "last_seen": "2026-04-11T19:13:17.495Z",
      "signatures": [
        "ET SCAN JAWS Webserver Unauthenticated Shell Command Execution",
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Web Application Attack"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        60001
      ],
      "protocols": [
        "TCP"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 135761,
      "as_org": "Userlinks Netcom Pvt. Ltd.",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T19:12:12+00:00",
        "last_seen_30d": "2026-04-11T19:13:17.495000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Honeytrap": 1
      }
    },
    "103.99.196.2": {
      "alert_count": 4,
      "first_seen": "2026-04-21T19:32:50.933Z",
      "last_seen": "2026-04-21T19:33:57.725Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        80
      ],
      "protocols": [
        "TCP"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "New Delhi",
      "asn": 141275,
      "as_org": "Maxnet Digital Pvt Ltd",
      "threat_score": 9.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-04-21T19:32:50.933000+00:00",
        "last_seen_30d": "2026-04-21T19:33:57.725000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4
      }
    },
    "110.37.9.197": {
      "alert_count": 4,
      "first_seen": "2026-04-12T09:30:01.189Z",
      "last_seen": "2026-04-12T09:31:02.750Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        80
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 38264,
      "as_org": "National WiMAXIMS environment",
      "threat_score": 5.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-04-12T09:30:01.189000+00:00",
        "last_seen_30d": "2026-04-12T09:31:02.750000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4
      }
    },
    "112.196.109.146": {
      "alert_count": 4,
      "first_seen": "2026-04-07T16:07:43.565Z",
      "last_seen": "2026-04-18T15:38:41.068Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11910 anomalous ICMPv4 type 3,code 4 Path MTU Discovery"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [],
      "protocols": [
        "ICMP"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Panchkula",
      "asn": 17917,
      "as_org": "Quadrant Televentures Limited",
      "threat_score": 12.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 10.0,
        "diversity": 0,
        "spread": 5,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 12,
        "ports_targeted_30d": 0,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-04-07T16:07:43.565000+00:00",
        "last_seen_30d": "2026-04-18T15:38:41.068000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4
      }
    },
    "117.244.67.83": {
      "alert_count": 4,
      "first_seen": "2026-04-05T05:41:52.042Z",
      "last_seen": "2026-04-05T05:42:57.850Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        80
      ],
      "protocols": [
        "TCP"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Kollam",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-04-05T05:41:52.042000+00:00",
        "last_seen_30d": "2026-04-05T05:42:57.850000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4
      }
    },
    "119.185.166.95": {
      "alert_count": 4,
      "first_seen": "2026-04-25T21:56:33.146Z",
      "last_seen": "2026-04-25T21:57:43.323Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        7574
      ],
      "protocols": [
        "TCP"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 16.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-25T21:56:31+00:00",
        "last_seen_30d": "2026-04-25T21:57:43.323000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Honeytrap": 1
      }
    },
    "119.30.116.198": {
      "alert_count": 4,
      "first_seen": "2026-04-06T06:56:23.147Z",
      "last_seen": "2026-04-06T06:57:33.217Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        80
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 58470,
      "as_org": "IX Peering for Mobilink and Link Direct International.",
      "threat_score": 2.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-04-06T06:56:23.147000+00:00",
        "last_seen_30d": "2026-04-06T06:57:33.217000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4
      }
    },
    "120.240.178.134": {
      "alert_count": 4,
      "first_seen": "2026-04-01T13:08:22.438Z",
      "last_seen": "2026-04-01T13:09:26.265Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        80
      ],
      "protocols": [
        "TCP"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 9808,
      "as_org": "China Mobile Communications Group Co., Ltd.",
      "threat_score": 1.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-04-01T13:08:22.438000+00:00",
        "last_seen_30d": "2026-04-01T13:09:26.265000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4
      }
    },
    "120.85.113.142": {
      "alert_count": 4,
      "first_seen": "2026-04-11T02:06:47.911Z",
      "last_seen": "2026-04-11T02:07:49.458Z",
      "signatures": [
        "ET SCAN JAWS Webserver Unauthenticated Shell Command Execution",
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Web Application Attack"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        80
      ],
      "protocols": [
        "TCP"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 17622,
      "as_org": "China Unicom Guangzhou network",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T02:06:47.615000+00:00",
        "last_seen_30d": "2026-04-11T02:07:49.458000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Tanner": 1
      }
    },
    "139.135.46.251": {
      "alert_count": 4,
      "first_seen": "2026-04-14T22:26:32.148Z",
      "last_seen": "2026-04-14T22:36:37.572Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        5555
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 9.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-14T22:26:21.599000+00:00",
        "last_seen_30d": "2026-04-14T22:36:37.572000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Adbhoney": 2
      }
    },
    "139.218.43.94": {
      "alert_count": 4,
      "first_seen": "2026-04-22T08:32:24.624Z",
      "last_seen": "2026-04-22T08:33:27.578Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        80
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 9443,
      "as_org": "Vocus Retail",
      "threat_score": 10.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-04-22T08:32:24.624000+00:00",
        "last_seen_30d": "2026-04-22T08:33:27.578000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4
      }
    },
    "170.84.134.203": {
      "alert_count": 4,
      "first_seen": "2026-04-26T08:47:50.020Z",
      "last_seen": "2026-04-26T08:48:59.614Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        80
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Nicaragua",
      "country_code": "NI",
      "city": "Managua",
      "asn": 263765,
      "as_org": "XINWEI INTELCOM.NIC, S.A.",
      "threat_score": 12.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-04-26T08:47:50.020000+00:00",
        "last_seen_30d": "2026-04-26T08:48:59.614000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4
      }
    },
    "172.105.186.116": {
      "alert_count": 4,
      "first_seen": "2026-04-01T06:07:44.720Z",
      "last_seen": "2026-04-30T23:35:30.575Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11910 anomalous ICMPv4 type 3,code 4 Path MTU Discovery"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        53
      ],
      "protocols": [
        "UDP",
        "ICMP"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 38.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 6.0,
        "persistence": 25,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 30,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-04-01T06:07:44.720000+00:00",
        "last_seen_30d": "2026-04-30T23:35:30.575000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4
      }
    },
    "175.107.211.49": {
      "alert_count": 4,
      "first_seen": "2026-04-17T00:10:55.656Z",
      "last_seen": "2026-04-17T00:17:18.856Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        5555
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-17T00:10:37.334000+00:00",
        "last_seen_30d": "2026-04-17T00:17:18.856000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Adbhoney": 2
      }
    },
    "175.107.237.17": {
      "alert_count": 4,
      "first_seen": "2026-04-13T04:48:56.758Z",
      "last_seen": "2026-04-13T04:52:05.427Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        5555
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 8.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-13T04:48:46.100000+00:00",
        "last_seen_30d": "2026-04-13T04:53:46.117000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Adbhoney": 2
      }
    },
    "19.79.13.89": {
      "alert_count": 4,
      "first_seen": "2026-04-13T22:18:16.846Z",
      "last_seen": "2026-04-26T18:36:21.101Z",
      "signatures": [
        "GPL SCAN loopback traffic"
      ],
      "categories": [
        "Potentially Bad Traffic"
      ],
      "severities": [
        2
      ],
      "dest_ports": [
        1594,
        52124,
        54119
      ],
      "protocols": [
        "UDP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null,
      "threat_score": 24.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 6.0,
        "persistence": 11.7,
        "diversity": 6,
        "spread": 5,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 14,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-04-13T22:18:16.846000+00:00",
        "last_seen_30d": "2026-04-26T18:36:21.101000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4
      }
    },
    "222.137.83.178": {
      "alert_count": 4,
      "first_seen": "2026-04-17T21:26:21.279Z",
      "last_seen": "2026-04-17T21:27:23.044Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        80
      ],
      "protocols": [
        "TCP"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Zhengzhou",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 7.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-04-17T21:26:21.279000+00:00",
        "last_seen_30d": "2026-04-17T21:27:23.044000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4
      }
    },
    "36.255.45.25": {
      "alert_count": 4,
      "first_seen": "2026-04-11T17:24:54.885Z",
      "last_seen": "2026-04-11T17:24:54.887Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        7574
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-11T17:23:48+00:00",
        "last_seen_30d": "2026-04-11T17:24:54.887000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Honeytrap": 1
      }
    },
    "42.236.213.216": {
      "alert_count": 4,
      "first_seen": "2026-04-02T01:31:00.753Z",
      "last_seen": "2026-04-02T01:32:13.413Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        7574
      ],
      "protocols": [
        "TCP"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 2.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-02T01:30:58+00:00",
        "last_seen_30d": "2026-04-02T01:32:13.413000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Honeytrap": 1
      }
    },
    "45.230.66.124": {
      "alert_count": 4,
      "first_seen": "2026-04-19T23:01:16.502Z",
      "last_seen": "2026-04-19T23:02:21.524Z",
      "signatures": [
        "ET SCAN JAWS Webserver Unauthenticated Shell Command Execution",
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Web Application Attack"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        80
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Oliveros",
      "asn": 266702,
      "as_org": "MEGALINK S.R.L.",
      "threat_score": 12.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-19T23:01:16.094000+00:00",
        "last_seen_30d": "2026-04-19T23:02:21.524000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Tanner": 1
      }
    },
    "69.55.60.123": {
      "alert_count": 4,
      "first_seen": "2026-04-04T14:13:11.045Z",
      "last_seen": "2026-04-04T14:18:12.474Z",
      "signatures": [
        "ET EXPLOIT Possible Authenticated Command Injection Inbound - Comtrend VR-3033 (CVE-2020-10173)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        80
      ],
      "protocols": [
        "TCP",
        "ICMP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-04-04T14:13:11.045000+00:00",
        "last_seen_30d": "2026-04-04T14:18:12.474000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4
      }
    },
    "72.255.19.32": {
      "alert_count": 4,
      "first_seen": "2026-04-16T16:05:30.149Z",
      "last_seen": "2026-04-16T16:06:44.298Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        7574
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T16:05:28+00:00",
        "last_seen_30d": "2026-04-16T16:06:44.298000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Honeytrap": 1
      }
    },
    "72.255.26.161": {
      "alert_count": 4,
      "first_seen": "2026-04-16T01:26:04.951Z",
      "last_seen": "2026-04-16T01:36:10.471Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        5555
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 11.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-16T01:25:50.383000+00:00",
        "last_seen_30d": "2026-04-16T01:36:10.471000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Adbhoney": 2
      }
    },
    "221.20.152.192": {
      "alert_count": 3,
      "first_seen": "2026-04-11T04:07:13.342Z",
      "last_seen": "2026-04-21T11:26:43.399Z",
      "signatures": [
        "GPL SCAN loopback traffic"
      ],
      "categories": [
        "Potentially Bad Traffic"
      ],
      "severities": [
        2
      ],
      "dest_ports": [
        46684,
        1120
      ],
      "protocols": [
        "UDP"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": null,
      "asn": 17676,
      "as_org": "SoftBank Corp.",
      "threat_score": 16.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 9.2,
        "diversity": 4,
        "spread": 5,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 11,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-04-11T04:07:13.342000+00:00",
        "last_seen_30d": "2026-04-21T11:26:43.399000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3
      }
    },
    "122.202.169.65": {
      "alert_count": 2,
      "first_seen": "2026-04-07T21:13:19.409Z",
      "last_seen": "2026-04-07T21:13:52.399Z",
      "signatures": [
        "GPL SCAN loopback traffic"
      ],
      "categories": [
        "Potentially Bad Traffic"
      ],
      "severities": [
        2
      ],
      "dest_ports": [
        61083
      ],
      "protocols": [
        "UDP"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Jeju City",
      "asn": 9946,
      "as_org": "KCTV JEJU BROADCASTING",
      "threat_score": 2.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 3.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 2,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-04-07T21:13:19.409000+00:00",
        "last_seen_30d": "2026-04-07T21:13:52.399000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Suricata": 2
      }
    },
    "128.26.175.217": {
      "alert_count": 2,
      "first_seen": "2026-04-10T13:04:56.241Z",
      "last_seen": "2026-04-10T13:05:26.325Z",
      "signatures": [
        "GPL SCAN loopback traffic"
      ],
      "categories": [
        "Potentially Bad Traffic"
      ],
      "severities": [
        2
      ],
      "dest_ports": [
        40003
      ],
      "protocols": [
        "UDP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 749,
      "as_org": "United States Department of Defense DoD",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 3.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 2,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-04-10T13:04:56.241000+00:00",
        "last_seen_30d": "2026-04-10T13:05:26.325000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Suricata": 2
      }
    },
    "131.66.226.48": {
      "alert_count": 2,
      "first_seen": "2026-04-01T03:12:56.634Z",
      "last_seen": "2026-04-01T03:13:32.764Z",
      "signatures": [
        "GPL SCAN loopback traffic"
      ],
      "categories": [
        "Potentially Bad Traffic"
      ],
      "severities": [
        2
      ],
      "dest_ports": [
        6837
      ],
      "protocols": [
        "UDP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 138,
      "as_org": "United States Department of Defense DoD",
      "threat_score": 1.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 3.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 2,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-04-01T03:12:56.634000+00:00",
        "last_seen_30d": "2026-04-01T03:13:32.764000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Suricata": 2
      }
    },
    "154.121.188.181": {
      "alert_count": 2,
      "first_seen": "2026-04-24T05:00:10.687Z",
      "last_seen": "2026-04-24T05:00:42.672Z",
      "signatures": [
        "GPL SCAN loopback traffic"
      ],
      "categories": [
        "Potentially Bad Traffic"
      ],
      "severities": [
        2
      ],
      "dest_ports": [
        3417
      ],
      "protocols": [
        "UDP"
      ],
      "country": "Algeria",
      "country_code": "DZ",
      "city": null,
      "asn": 327712,
      "as_org": "ATM",
      "threat_score": 8.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 3.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 2,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-04-24T05:00:10.687000+00:00",
        "last_seen_30d": "2026-04-24T05:00:42.672000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 2
      }
    },
    "156.159.40.230": {
      "alert_count": 2,
      "first_seen": "2026-04-20T22:27:35.507Z",
      "last_seen": "2026-04-20T22:28:13.205Z",
      "signatures": [
        "GPL SCAN loopback traffic"
      ],
      "categories": [
        "Potentially Bad Traffic"
      ],
      "severities": [
        2
      ],
      "dest_ports": [
        43807
      ],
      "protocols": [
        "UDP"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": null,
      "asn": null,
      "as_org": null,
      "threat_score": 7.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 3.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 2,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-04-20T22:27:35.507000+00:00",
        "last_seen_30d": "2026-04-20T22:28:13.205000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 2
      }
    },
    "2.171.236.19": {
      "alert_count": 2,
      "first_seen": "2026-04-16T19:22:05.404Z",
      "last_seen": "2026-04-16T19:22:44.016Z",
      "signatures": [
        "GPL SCAN loopback traffic"
      ],
      "categories": [
        "Potentially Bad Traffic"
      ],
      "severities": [
        2
      ],
      "dest_ports": [
        28230
      ],
      "protocols": [
        "UDP"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 3320,
      "as_org": "Deutsche Telekom AG",
      "threat_score": 5.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 3.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 2,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-04-16T19:22:05.404000+00:00",
        "last_seen_30d": "2026-04-16T19:22:44.016000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Suricata": 2
      }
    },
    "25.85.41.46": {
      "alert_count": 2,
      "first_seen": "2026-04-09T09:14:22.294Z",
      "last_seen": "2026-04-09T09:15:01.795Z",
      "signatures": [
        "GPL SCAN loopback traffic"
      ],
      "categories": [
        "Potentially Bad Traffic"
      ],
      "severities": [
        2
      ],
      "dest_ports": [
        11127
      ],
      "protocols": [
        "UDP"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": null,
      "as_org": null,
      "threat_score": 3.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 3.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 2,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-04-09T09:14:22.294000+00:00",
        "last_seen_30d": "2026-04-09T09:15:01.795000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Suricata": 2
      }
    },
    "3.95.117.192": {
      "alert_count": 2,
      "first_seen": "2026-04-08T13:36:09.209Z",
      "last_seen": "2026-04-08T13:36:44.141Z",
      "signatures": [
        "GPL SCAN loopback traffic"
      ],
      "categories": [
        "Potentially Bad Traffic"
      ],
      "severities": [
        2
      ],
      "dest_ports": [
        17670
      ],
      "protocols": [
        "UDP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 3.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 2,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-04-08T13:36:09.209000+00:00",
        "last_seen_30d": "2026-04-08T13:36:44.141000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Suricata": 2
      }
    },
    "45.249.103.4": {
      "alert_count": 2,
      "first_seen": "2026-04-11T22:15:18.026Z",
      "last_seen": "2026-04-11T22:15:49.089Z",
      "signatures": [
        "GPL SCAN loopback traffic"
      ],
      "categories": [
        "Potentially Bad Traffic"
      ],
      "severities": [
        2
      ],
      "dest_ports": [
        32865
      ],
      "protocols": [
        "UDP"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 63526,
      "as_org": "Systems Solutions & development Technologies Limited",
      "threat_score": 4.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 3.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 2,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-04-11T22:15:18.026000+00:00",
        "last_seen_30d": "2026-04-11T22:15:49.089000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 2
      }
    },
    "51.244.213.167": {
      "alert_count": 2,
      "first_seen": "2026-04-26T07:17:50.231Z",
      "last_seen": "2026-04-26T07:18:22.120Z",
      "signatures": [
        "GPL SCAN loopback traffic"
      ],
      "categories": [
        "Potentially Bad Traffic"
      ],
      "severities": [
        2
      ],
      "dest_ports": [
        28467
      ],
      "protocols": [
        "UDP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 3.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 2,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-04-26T07:17:50.231000+00:00",
        "last_seen_30d": "2026-04-26T07:18:22.120000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 2
      }
    },
    "71.102.182.162": {
      "alert_count": 2,
      "first_seen": "2026-04-07T06:11:37.590Z",
      "last_seen": "2026-04-07T06:12:08.238Z",
      "signatures": [
        "GPL SCAN loopback traffic"
      ],
      "categories": [
        "Potentially Bad Traffic"
      ],
      "severities": [
        2
      ],
      "dest_ports": [
        37802
      ],
      "protocols": [
        "UDP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 701,
      "as_org": "Verizon Business",
      "threat_score": 2.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 3.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 2,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-04-07T06:11:37.590000+00:00",
        "last_seen_30d": "2026-04-07T06:12:08.238000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Suricata": 2
      }
    },
    "202.112.237.200": {
      "alert_count": 1,
      "first_seen": "2026-04-01T04:56:25.968Z",
      "last_seen": "2026-04-01T04:56:25.968Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11910 anomalous ICMPv4 type 3,code 4 Path MTU Discovery"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [],
      "protocols": [
        "ICMP"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4538,
      "as_org": "China Education and Research Network Center",
      "threat_score": 0.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 0.0,
        "persistence": 0.8,
        "diversity": 0,
        "spread": 5,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 1,
        "days_active_30d": 1,
        "ports_targeted_30d": 0,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-04-01T04:56:25.968000+00:00",
        "last_seen_30d": "2026-04-01T04:56:25.968000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1
      }
    },
    "64.62.197.225": {
      "alert_count": 14,
      "first_seen": "2026-04-03T12:03:20.835Z",
      "last_seen": "2026-04-30T03:48:52.991Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free",
        "SURICATA STREAM Packet with broken ack"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Generic Protocol Command Decode"
      ],
      "severities": [
        1,
        3
      ],
      "dest_ports": [
        80,
        811,
        1337,
        3306,
        5081,
        5800,
        5803,
        22222,
        51200,
        58888
      ],
      "protocols": [
        "TCP",
        "IP-in-IP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 65.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 12.0,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 28,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-03T12:03:20.835000+00:00",
        "last_seen_30d": "2026-04-30T03:48:52.991000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 14,
        "Honeytrap": 2
      }
    },
    "120.28.124.40": {
      "alert_count": 6,
      "first_seen": "2026-04-27T20:51:32.470Z",
      "last_seen": "2026-04-27T20:51:32.472Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)",
        "SURICATA HTTP Unexpected Request body"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Generic Protocol Command Decode"
      ],
      "severities": [
        1,
        3
      ],
      "dest_ports": [
        49152
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "San Juan",
      "asn": 132199,
      "as_org": "Globe Telecom Inc.",
      "threat_score": 19.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-04-27T20:50:26+00:00",
        "last_seen_30d": "2026-04-27T20:51:32.472000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Honeytrap": 1
      }
    },
    "190.114.40.83": {
      "alert_count": 5,
      "first_seen": "2026-04-06T13:52:11.466Z",
      "last_seen": "2026-04-06T13:53:11.866Z",
      "signatures": [
        "ET EXPLOIT Possible Authenticated Command Injection Inbound - Comtrend VR-3033 (CVE-2020-10173)",
        "SURICATA HTTP missing Host header"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Generic Protocol Command Decode"
      ],
      "severities": [
        1,
        3
      ],
      "dest_ports": [
        80
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "Santiago",
      "asn": 27901,
      "as_org": "Pacifico Cable SPA.",
      "threat_score": 3.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-04-06T13:52:11.466000+00:00",
        "last_seen_30d": "2026-04-06T13:53:11.866000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5
      }
    },
    "110.37.31.174": {
      "alert_count": 4,
      "first_seen": "2026-04-27T03:33:13.425Z",
      "last_seen": "2026-04-27T03:34:14.132Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        80
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 38264,
      "as_org": "National WiMAXIMS environment",
      "threat_score": 12.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-04-27T03:33:13.425000+00:00",
        "last_seen_30d": "2026-04-27T03:34:14.132000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4
      }
    }
  },
  "x_nadsec_summary": {
    "top_countries": {
      "Netherlands": 1546,
      "United States": 575,
      "China": 72,
      "Pakistan": 53,
      "Taiwan": 42,
      "India": 30,
      "Australia": 14,
      "Brazil": 10,
      "Germany": 9,
      "Algeria": 8,
      "United Kingdom": 7,
      "Philippines": 6,
      "South Africa": 5,
      "Indonesia": 5,
      "Paraguay": 5,
      "Ecuador": 5,
      "T\u00fcrkiye": 5,
      "Russia": 5,
      "United Arab Emirates": 5,
      "Chile": 5
    },
    "top_asns": {
      "IP Volume inc": 1546,
      "Hurricane Electric LLC": 434,
      "Cincinnati Bell Telephone Company LLC": 50,
      "Data Communication Business Group": 42,
      "Cyber Internet Services Pvt Ltd.": 41,
      "China Education and Research Network Center": 29,
      "CHINA UNICOM China169 Backbone": 22,
      "Charter Communications Inc": 21,
      "Comcast Cable Communications, LLC": 15,
      "Space Exploration Technologies Corporation": 15,
      "AT&T Enterprises, LLC": 9,
      "China Unicom Guangzhou network": 9,
      "Cogent Communications, LLC": 8,
      "China Enterprise ICT Solutions Limited": 8,
      "Userlinks Netcom Pvt. Ltd.": 8,
      "National WiMAXIMS environment": 8,
      "CloudKleyer Frankfurt GmbH": 7,
      "Microplex PTY LTD": 6,
      "Telecom Algeria": 6,
      "Globe Telecom Inc.": 6
    },
    "top_signatures": {
      "ET SCAN Mirai Variant User-Agent (Inbound)": 33,
      "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free": 25,
      "ET EXPLOIT Possible Authenticated Command Injection Inbound - Comtrend VR-3033 (CVE-2020-10173)": 22,
      "SURICATA HTTP missing Host header": 21,
      "GPL SCAN loopback traffic": 14,
      "SURICATA HTTP Unexpected Request body": 7,
      "ET EXPLOIT Possible CVE-2020-11910 anomalous ICMPv4 type 3,code 4 Path MTU Discovery": 6,
      "ET INFO SSH session in progress on Unusual Port": 4,
      "ET SCAN JAWS Webserver Unauthenticated Shell Command Execution": 3,
      "SURICATA STREAM Packet with broken ack": 2,
      "SURICATA STREAM spurious retransmission": 1,
      "ET REMOTE_ACCESS Tunneled RDP msts Handshake": 1,
      "ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound": 1,
      "ET EXPLOIT Possible VXWORKS Urgent11 RCE Attempt - Illegal Urgent Flag": 1,
      "ET EXPLOIT Possible VXWORKS Urgent11 RCE Attempt - Urgent Flag": 1,
      "SURICATA STREAM RST recv but no session": 1,
      "ET INFO SSH session in progress on Expected Port": 1,
      "SURICATA STREAM Packet with invalid timestamp": 1,
      "ET INFO Cleartext WordPress Login": 1
    },
    "top_categories": {
      "Attempted Administrator Privilege Gain": 88,
      "Generic Protocol Command Decode": 32,
      "Potentially Bad Traffic": 15,
      "Misc activity": 5,
      "Web Application Attack": 3,
      "Potential Corporate Privacy Violation": 1
    },
    "severity_distribution": {
      "1": 89,
      "2": 15,
      "3": 37
    },
    "targeted_ports": {
      "80": 40,
      "3389": 7,
      "443": 7,
      "49152": 7,
      "2031": 6,
      "9200": 5,
      "4080": 5,
      "5555": 5,
      "8080": 5,
      "23": 4
    },
    "protocols": {
      "TCP": 85,
      "UDP": 29,
      "IP-in-IP": 25,
      "ICMP": 8
    }
  },
  "x_mitre_attack": {
    "techniques": {
      "T1068": {
        "name": "Exploitation for Privilege Escalation",
        "tactic": "Privilege Escalation",
        "ip_count": 88,
        "sample_signatures": []
      },
      "T1190": {
        "name": "Exploit Public-Facing Application",
        "tactic": "Initial Access",
        "ip_count": 58,
        "sample_signatures": [
          "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free",
          "ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound",
          "ET EXPLOIT Possible VXWORKS Urgent11 RCE Attempt - Illegal Urgent Flag"
        ]
      },
      "T1071": {
        "name": "Application Layer Protocol",
        "tactic": "Command and Control",
        "ip_count": 51,
        "sample_signatures": []
      },
      "T1595": {
        "name": "Active Scanning",
        "tactic": "Reconnaissance",
        "ip_count": 47,
        "sample_signatures": [
          "ET SCAN Mirai Variant User-Agent (Inbound)",
          "GPL SCAN loopback traffic",
          "ET SCAN JAWS Webserver Unauthenticated Shell Command Execution"
        ]
      },
      "T1592": {
        "name": "Gather Victim Host Information",
        "tactic": "Reconnaissance",
        "ip_count": 6,
        "sample_signatures": [
          "ET INFO SSH session in progress on Expected Port",
          "ET INFO SSH session in progress on Unusual Port",
          "ET INFO Cleartext WordPress Login"
        ]
      },
      "T1005": {
        "name": "Data from Local System",
        "tactic": "Collection",
        "ip_count": 1,
        "sample_signatures": []
      }
    },
    "tactic_summary": {
      "Privilege Escalation": 88,
      "Initial Access": 58,
      "Reconnaissance": 53,
      "Command and Control": 51,
      "Collection": 1
    },
    "technique_count": 6,
    "primary_tactics": [
      "Privilege Escalation",
      "Initial Access",
      "Reconnaissance"
    ]
  },
  "x_nadsec_threat_summary": {
    "total_ips": 104,
    "scored_ips": 104,
    "threat_distribution": {
      "critical": 0,
      "high": 16,
      "medium": 11,
      "low": 6,
      "minimal": 71,
      "unknown": 0
    },
    "avg_threat_score": 22.2,
    "max_threat_score": 72.4,
    "top_threats": [
      {
        "ip": "65.49.1.141",
        "threat_score": 72.4,
        "threat_level": "high",
        "total_events": 26,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "64.62.156.149",
        "threat_score": 72.2,
        "threat_level": "high",
        "total_events": 16,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "65.49.1.196",
        "threat_score": 69.7,
        "threat_level": "high",
        "total_events": 24,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "64.62.197.94",
        "threat_score": 69.1,
        "threat_level": "high",
        "total_events": 21,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "64.62.156.193",
        "threat_score": 68.9,
        "threat_level": "high",
        "total_events": 25,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "184.105.247.248",
        "threat_score": 67.2,
        "threat_level": "high",
        "total_events": 17,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "64.62.197.99",
        "threat_score": 67.0,
        "threat_level": "high",
        "total_events": 15,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "184.105.139.109",
        "threat_score": 66.8,
        "threat_level": "high",
        "total_events": 14,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "94.102.49.51",
        "threat_score": 66.7,
        "threat_level": "high",
        "total_events": 1546,
        "country": "Netherlands",
        "org": "IP Volume inc"
      },
      {
        "ip": "184.105.247.244",
        "threat_score": 66.7,
        "threat_level": "high",
        "total_events": 47,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "64.62.197.225",
        "threat_score": 65.4,
        "threat_level": "high",
        "total_events": 14,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "65.49.1.214",
        "threat_score": 64.1,
        "threat_level": "high",
        "total_events": 26,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "64.62.197.8",
        "threat_score": 63.7,
        "threat_level": "high",
        "total_events": 13,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "65.49.1.112",
        "threat_score": 61.9,
        "threat_level": "high",
        "total_events": 19,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "65.49.1.127",
        "threat_score": 60.4,
        "threat_level": "high",
        "total_events": 15,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "65.49.20.111",
        "threat_score": 60.1,
        "threat_level": "high",
        "total_events": 15,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "184.105.139.119",
        "threat_score": 59.4,
        "threat_level": "medium",
        "total_events": 22,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "64.62.197.169",
        "threat_score": 58.9,
        "threat_level": "medium",
        "total_events": 12,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "184.105.247.214",
        "threat_score": 58.4,
        "threat_level": "medium",
        "total_events": 16,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "64.62.197.55",
        "threat_score": 58.1,
        "threat_level": "medium",
        "total_events": 14,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      }
    ]
  }
}