{
  "id": "bundle--045fc969-063c-4a2c-b077-045e2385306e",
  "objects": [
    {
      "created": "2026-05-01T05:10:01.713Z",
      "created_by_ref": "identity--ab072f15-9b87-4ee1-898f-b584d41f29b0",
      "description": "Rolling monthly view of source IPv4 addresses that triggered Suricata severity 1\u20132 (high & medium) IDS alerts on a T-Pot honeypot. Each run looks back the last 1h and appends newly seen IPs for this month. Location: Australia.",
      "id": "report--045fc969-063c-4a2c-b077-045e2385306e",
      "labels": [
        "threat-report"
      ],
      "modified": "2026-05-31T13:10:09.442Z",
      "name": "Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "object_refs": [
        "identity--ab072f15-9b87-4ee1-898f-b584d41f29b0",
        "indicator--cf9ac611-b45e-4774-8143-522675fcda19",
        "indicator--2270571c-e13c-4114-8f79-08de29938a54",
        "indicator--32f6bfcd-4ac2-438b-b315-3b97f9dc5f0d",
        "indicator--e7f426f0-3e50-427b-82f0-ab4a35fc765d",
        "indicator--1dfefce0-2f29-4eca-b68b-18d97ddb8f6c",
        "indicator--680323c5-bdd7-40ad-b149-4a367313db52",
        "indicator--05a0a6ce-e91b-40dc-99e1-583f33d6309c",
        "indicator--8dcbee0f-c1ec-44f4-917a-40e89f832f75",
        "indicator--7b5d5579-398f-4a81-bab4-7edd7194cbf7",
        "indicator--39da7748-621a-47b0-8c61-3449eb975f7a",
        "indicator--d89d5984-cc9d-4592-b218-465d8cc4627b",
        "indicator--81e13fb5-c612-40e8-9d0c-4c4a2d4fdfc9",
        "indicator--c2d5f91d-ee4e-49b8-b119-7b4a69cd74de",
        "indicator--db546ed2-096f-4845-94ec-a8e87cdcc532",
        "indicator--fb1b2618-9e34-4e73-816d-3f334fe40ddf",
        "indicator--1f7aa692-feb8-441d-94d0-4eda93b8ec5e",
        "indicator--7c5cd45b-21f5-4509-8add-4624372b32c9",
        "indicator--d243ae6e-1c3e-482a-877e-21e6ee0a030f",
        "indicator--421dc0a6-0a07-449f-a3f2-43ca32bb2978",
        "indicator--a1afa33e-c76e-436c-afe5-4cbfd1dcf1e1",
        "indicator--6d345e49-3204-49f6-bdbe-246bee65b0fa",
        "indicator--e892bcaf-c0b3-4130-935b-33457865826a",
        "indicator--c3b15e75-ac0d-4824-b253-187b7735bfec",
        "indicator--7cfeb8ef-0a83-4ce4-b2b1-fba9b4091c5e",
        "indicator--bd3362bf-e101-4294-9998-f6b523e16909",
        "indicator--1efb4c12-d01a-4427-86d8-506e6be83dba",
        "indicator--19071a37-fc9c-4106-9e37-14fffee706b2",
        "indicator--499e3123-d776-4e3e-b5a2-5de9ded0f555",
        "indicator--f87fc271-eef9-4a7f-9440-a15d3efabcc0",
        "indicator--fc820106-ea0f-4c42-a1be-0c7a033cef78",
        "indicator--8dbf2e62-9fa7-4f9e-8b32-b4425ffe4968",
        "indicator--0ae92128-10ca-4f61-a7be-0d7650ae1c12",
        "indicator--832c2e76-ca95-4bd0-aeab-9ba3d4d35156",
        "indicator--78e0eb4d-af2b-4404-bf7b-ecd1ecf4ac3a",
        "indicator--5a749a7b-c7b4-4212-a63e-ccb71460ea6e",
        "indicator--d5fd8f98-3126-42f3-971d-b5f1937c10cf",
        "indicator--e051f103-82a9-4596-875b-380594801a83",
        "indicator--66b9d799-cf16-40ad-ad66-8490b7b3a0f3",
        "indicator--0f7cccb4-554b-446f-8fda-2558a73cb45e",
        "indicator--f3a8273f-9243-44f1-a5ee-cd7ed805faf4",
        "indicator--862a33ee-a5c5-4179-9f3c-f77bcf056bdf",
        "indicator--a7fd9448-bc82-4294-badf-4f3d47589642",
        "indicator--edf9f863-84f3-48ab-be00-7bae3adf7923",
        "indicator--e016b143-4317-4988-aab0-29960d378845",
        "indicator--42484ff2-d90b-42eb-a5a1-d8a5d150db02",
        "indicator--af5417fe-8e52-46de-9c31-51f6937d148c",
        "indicator--86a31698-0aa3-4e3f-a9bc-b2387518603d",
        "indicator--de1ffe24-09c3-483e-9afa-ee9bd2790d3f",
        "indicator--e7e35f70-4192-4fae-98c1-82259f9fde37",
        "indicator--4bad9962-3f05-47af-9371-d1a52b62acd4",
        "indicator--a55f8348-552d-479c-9577-dba47b6b07e7",
        "indicator--b5b58ac3-2946-4813-83c6-75b11d1a57f8",
        "indicator--ac28825a-1b77-41e1-92c0-77c60a2a3129",
        "indicator--4cd6c3b7-4cb8-4ed7-8981-87b5da9e30c9",
        "indicator--834bb257-f278-45d0-a132-8f5bd347f70a",
        "indicator--898a5adc-65e5-41c0-9225-3ae8881fee9b",
        "indicator--81fde9ef-6348-4173-8bd7-033014aa8ad1",
        "indicator--8147baa3-959e-427b-be0d-fd6ab972612a",
        "indicator--4d970726-3783-442b-b42d-11e147d80c68",
        "indicator--fff91c98-43f2-4fa7-b748-8f3463637c98",
        "indicator--e94831b8-1a23-4434-a45d-8e043d972bd5",
        "indicator--3f851bec-3bcd-40a6-a634-155970c84a51",
        "indicator--5e30305b-3f57-4cee-a73c-f160f82f5837",
        "indicator--0b8454ae-01fb-4741-894a-3d7f81f4aabb",
        "indicator--af36fa18-2cb4-4b79-969d-9421b037ffb9",
        "indicator--62d072ea-5497-4aec-9eb5-9ba15c0d700a",
        "indicator--6450c4a5-a706-463a-bd33-2a060ab187b2",
        "indicator--e6882679-8b95-450c-957d-67fe3ea416e6",
        "indicator--ba0437ce-a3c8-4d7d-b981-2faeeb202612",
        "indicator--7b8de1bb-b42a-4e94-9f10-9c2b0088c215",
        "indicator--7eb1ecc4-ddd4-463e-a729-6c6b17e0be6d",
        "indicator--e58a0a38-6d59-43e7-9b5f-ec3fdc75c00c",
        "indicator--787f18a0-6860-4bc1-af1a-12cdd210f36b",
        "indicator--683308a0-a8b2-4f70-9af8-30f07c866419",
        "indicator--60a6875b-5756-4f4f-bb27-76cfb4bee460"
      ],
      "published": "2026-05-01T05:10:01.713Z",
      "spec_version": "2.1",
      "type": "report"
    },
    {
      "contact_information": "https://otx.alienvault.com/",
      "created": "2026-05-01T05:10:01.713Z",
      "id": "identity--ab072f15-9b87-4ee1-898f-b584d41f29b0",
      "identity_class": "organization",
      "modified": "2026-05-01T05:10:01.713Z",
      "name": "Open Threat Exchange",
      "spec_version": "2.1",
      "type": "identity"
    },
    {
      "created": "2026-05-01T05:10:02.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=CN; asn=4538; asn_org=China Education and Research Network Center",
      "id": "indicator--cf9ac611-b45e-4774-8143-522675fcda19",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-05-01T05:10:02.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '202.112.237.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T05:10:02.000Z",
      "valid_until": "2026-06-02T05:10:00.000Z"
    },
    {
      "created": "2026-05-01T09:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--2270571c-e13c-4114-8f79-08de29938a54",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-05-01T09:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T09:10:10.000Z",
      "valid_until": "2026-06-02T09:10:09.000Z"
    },
    {
      "created": "2026-05-01T13:10:04.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=5555; cc=PK; asn=59257; asn_org=CMPak Limited",
      "id": "indicator--32f6bfcd-4ac2-438b-b315-3b97f9dc5f0d",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-01T13:10:04.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '223.123.73.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T13:10:04.000Z",
      "valid_until": "2026-06-02T13:10:03.000Z"
    },
    {
      "created": "2026-05-02T09:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--e7f426f0-3e50-427b-82f0-ab4a35fc765d",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-05-02T09:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '184.105.139.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T09:10:10.000Z",
      "valid_until": "2026-06-03T09:10:08.000Z"
    },
    {
      "created": "2026-05-02T23:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible Authenticated Command Injection Inbound - Comtrend VR-3033 (CVE-2020-10173); ports=80; cc=US; asn=20115; asn_org=Charter Communications LLC",
      "id": "indicator--1dfefce0-2f29-4eca-b68b-18d97ddb8f6c",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-05-02T23:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '24.182.9.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T23:10:10.000Z",
      "valid_until": "2026-06-03T23:10:09.000Z"
    },
    {
      "created": "2026-05-03T09:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--680323c5-bdd7-40ad-b149-4a367313db52",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-05-03T09:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T09:10:10.000Z",
      "valid_until": "2026-06-04T09:10:09.000Z"
    },
    {
      "created": "2026-05-04T09:10:09.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--05a0a6ce-e91b-40dc-99e1-583f33d6309c",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-05-04T09:10:09.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T09:10:09.000Z",
      "valid_until": "2026-06-05T09:10:08.000Z"
    },
    {
      "created": "2026-05-04T23:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=80; cc=PK; asn=131275; asn_org=Logon Broadband Pvt. Limited",
      "id": "indicator--8dcbee0f-c1ec-44f4-917a-40e89f832f75",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-04T23:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '111.92.152.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T23:10:10.000Z",
      "valid_until": "2026-06-05T23:10:09.000Z"
    },
    {
      "created": "2026-05-05T08:10:04.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=80; cc=PK; asn=137047; asn_org=TELECOMMUNICATION AND TECHNOLOGY MASTERS PVT. LIMITED",
      "id": "indicator--7b5d5579-398f-4a81-bab4-7edd7194cbf7",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-05T08:10:04.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '119.160.215.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T08:10:04.000Z",
      "valid_until": "2026-06-06T08:10:03.000Z"
    },
    {
      "created": "2026-05-05T11:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--39da7748-621a-47b0-8c61-3449eb975f7a",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-05-05T11:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T11:10:10.000Z",
      "valid_until": "2026-06-06T11:10:09.000Z"
    },
    {
      "created": "2026-05-06T00:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=5555; cc=PK; asn=9541; asn_org=Cyber Internet Services Pvt Ltd.",
      "id": "indicator--d89d5984-cc9d-4592-b218-465d8cc4627b",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-06T00:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.167.166.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T00:10:10.000Z",
      "valid_until": "2026-06-07T00:10:09.000Z"
    },
    {
      "created": "2026-05-06T03:10:15.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11910 anomalous ICMPv4 type 3,code 4 Path MTU Discovery; cc=CN; asn=4538; asn_org=China Education and Research Network Center",
      "id": "indicator--81e13fb5-c612-40e8-9d0c-4c4a2d4fdfc9",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-05-06T03:10:15.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '202.112.237.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T03:10:15.000Z",
      "valid_until": "2026-06-07T03:10:08.000Z"
    },
    {
      "created": "2026-05-06T04:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11910 anomalous ICMPv4 type 3,code 4 Path MTU Discovery; cc=AU; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--c2d5f91d-ee4e-49b8-b119-7b4a69cd74de",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-05-06T04:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.105.186.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T04:10:10.000Z",
      "valid_until": "2026-06-07T04:10:09.000Z"
    },
    {
      "created": "2026-05-06T04:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=7574; cc=PK; asn=136525; asn_org=Wancom Pvt Ltd.",
      "id": "indicator--db546ed2-096f-4845-94ec-a8e87cdcc532",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-06T04:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '182.190.220.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T04:10:10.000Z",
      "valid_until": "2026-06-07T04:10:09.000Z"
    },
    {
      "created": "2026-05-06T12:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--fb1b2618-9e34-4e73-816d-3f334fe40ddf",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-05-06T12:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T12:10:10.000Z",
      "valid_until": "2026-06-07T12:10:09.000Z"
    },
    {
      "created": "2026-05-06T19:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound; ports=55555; cc=FR; asn=51167; asn_org=Contabo GmbH",
      "id": "indicator--1f7aa692-feb8-441d-94d0-4eda93b8ec5e",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-05-06T19:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '62.171.169.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T19:10:10.000Z",
      "valid_until": "2026-06-07T19:10:09.000Z"
    },
    {
      "created": "2026-05-07T01:10:09.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--7c5cd45b-21f5-4509-8add-4624372b32c9",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-05-07T01:10:09.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '184.105.247.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T01:10:09.000Z",
      "valid_until": "2026-06-08T01:10:08.000Z"
    },
    {
      "created": "2026-05-07T12:10:09.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=2; categories=Attempted Administrator Privilege Gain,Web Application Attack; sigs(top)=ET SCAN JAWS Webserver Unauthenticated Shell Command Execution; ET SCAN Mirai Variant User-Agent (Inbound); ports=60001; cc=PK; asn=138423; asn_org=CMPak Limited",
      "id": "indicator--d243ae6e-1c3e-482a-877e-21e6ee0a030f",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-07T12:10:09.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '117.134.197.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T12:10:09.000Z",
      "valid_until": "2026-06-08T12:10:08.000Z"
    },
    {
      "created": "2026-05-07T20:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=5555; cc=PK; asn=138423; asn_org=CMPak Limited",
      "id": "indicator--421dc0a6-0a07-449f-a3f2-43ca32bb2978",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-07T20:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '117.134.197.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T20:10:10.000Z",
      "valid_until": "2026-06-08T20:10:09.000Z"
    },
    {
      "created": "2026-05-08T09:10:09.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--a1afa33e-c76e-436c-afe5-4cbfd1dcf1e1",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-05-08T09:10:09.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T09:10:09.000Z",
      "valid_until": "2026-06-09T09:10:08.000Z"
    },
    {
      "created": "2026-05-08T20:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--6d345e49-3204-49f6-bdbe-246bee65b0fa",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-08T20:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '58.23.87.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T20:10:10.000Z",
      "valid_until": "2026-06-09T20:10:09.000Z"
    },
    {
      "created": "2026-05-08T21:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11910 anomalous ICMPv4 type 3,code 4 Path MTU Discovery; cc=US; asn=60068; asn_org=Datacamp Limited",
      "id": "indicator--e892bcaf-c0b3-4130-935b-33457865826a",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-05-08T21:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '89.187.182.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T21:10:10.000Z",
      "valid_until": "2026-06-09T21:10:09.000Z"
    },
    {
      "created": "2026-05-09T04:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--c3b15e75-ac0d-4824-b253-187b7735bfec",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-05-09T04:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T04:10:10.000Z",
      "valid_until": "2026-06-10T04:10:09.000Z"
    },
    {
      "created": "2026-05-09T18:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11910 anomalous ICMPv4 type 3,code 4 Path MTU Discovery; cc=DE; asn=215828; asn_org=TMW Global Networks",
      "id": "indicator--7cfeb8ef-0a83-4ce4-b2b1-fba9b4091c5e",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-05-09T18:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '77.90.25.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T18:10:10.000Z",
      "valid_until": "2026-06-10T18:10:09.000Z"
    },
    {
      "created": "2026-05-10T09:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--bd3362bf-e101-4294-9998-f6b523e16909",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-05-10T09:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T09:10:10.000Z",
      "valid_until": "2026-06-11T09:10:09.000Z"
    },
    {
      "created": "2026-05-10T13:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=5555; cc=IN; asn=135687; asn_org=Qwistel Network Service Private Limited",
      "id": "indicator--1efb4c12-d01a-4427-86d8-506e6be83dba",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-10T13:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.176.16.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T13:10:10.000Z",
      "valid_until": "2026-06-11T13:10:08.000Z"
    },
    {
      "created": "2026-05-11T11:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=2; categories=Attempted Administrator Privilege Gain,Web Application Attack; sigs(top)=ET SCAN JAWS Webserver Unauthenticated Shell Command Execution; ET SCAN Mirai Variant User-Agent (Inbound); ports=60001; cc=PK; asn=9541; asn_org=Cyber Internet Services Pvt Ltd.",
      "id": "indicator--19071a37-fc9c-4106-9e37-14fffee706b2",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-11T11:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '72.255.32.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T11:10:10.000Z",
      "valid_until": "2026-06-12T11:10:09.000Z"
    },
    {
      "created": "2026-05-12T10:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--499e3123-d776-4e3e-b5a2-5de9ded0f555",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-05-12T10:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T10:10:10.000Z",
      "valid_until": "2026-06-13T10:10:08.000Z"
    },
    {
      "created": "2026-05-12T23:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=8080; cc=CN; asn=17622; asn_org=China Unicom Guangzhou network",
      "id": "indicator--f87fc271-eef9-4a7f-9440-a15d3efabcc0",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-12T23:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '120.85.113.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T23:10:10.000Z",
      "valid_until": "2026-06-13T23:10:09.000Z"
    },
    {
      "created": "2026-05-13T11:10:07.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--fc820106-ea0f-4c42-a1be-0c7a033cef78",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-05-13T11:10:07.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T11:10:07.000Z",
      "valid_until": "2026-06-14T11:10:06.000Z"
    },
    {
      "created": "2026-05-13T12:10:04.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=5555; cc=IN; asn=135687; asn_org=Qwistel Network Service Private Limited",
      "id": "indicator--8dbf2e62-9fa7-4f9e-8b32-b4425ffe4968",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-13T12:10:04.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.176.16.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T12:10:04.000Z",
      "valid_until": "2026-06-14T12:10:03.000Z"
    },
    {
      "created": "2026-05-13T23:10:09.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=7574; cc=PK; asn=152605; asn_org=Z COM NETWORKS",
      "id": "indicator--0ae92128-10ca-4f61-a7be-0d7650ae1c12",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-13T23:10:09.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '38.100.223.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T23:10:09.000Z",
      "valid_until": "2026-06-14T23:10:08.000Z"
    },
    {
      "created": "2026-05-14T04:10:03.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Denial of Service; sigs(top)=GPL VOIP SIP INVITE message flooding; ports=5060; cc=US; asn=47890; asn_org=Unmanaged Ltd",
      "id": "indicator--832c2e76-ca95-4bd0-aeab-9ba3d4d35156",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-14T04:10:03.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.148.9.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T04:10:03.000Z",
      "valid_until": "2026-06-15T04:10:02.000Z"
    },
    {
      "created": "2026-05-14T11:10:05.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--78e0eb4d-af2b-4404-bf7b-ecd1ecf4ac3a",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-05-14T11:10:05.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T11:10:05.000Z",
      "valid_until": "2026-06-15T11:10:03.000Z"
    },
    {
      "created": "2026-05-15T11:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=5555; cc=PK; asn=9541; asn_org=Cyber Internet Services Pvt Ltd.",
      "id": "indicator--5a749a7b-c7b4-4212-a63e-ccb71460ea6e",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-15T11:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.1.104.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T11:10:10.000Z",
      "valid_until": "2026-06-16T11:10:09.000Z"
    },
    {
      "created": "2026-05-15T11:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--d5fd8f98-3126-42f3-971d-b5f1937c10cf",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-05-15T11:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T11:10:10.000Z",
      "valid_until": "2026-06-16T11:10:09.000Z"
    },
    {
      "created": "2026-05-15T20:10:04.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=CN; asn=4538; asn_org=China Education and Research Network Center",
      "id": "indicator--e051f103-82a9-4596-875b-380594801a83",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-05-15T20:10:04.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '202.112.237.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T20:10:04.000Z",
      "valid_until": "2026-06-16T20:10:03.000Z"
    },
    {
      "created": "2026-05-16T00:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--66b9d799-cf16-40ad-ad66-8490b7b3a0f3",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-05-16T00:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '184.105.247.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T00:10:10.000Z",
      "valid_until": "2026-06-17T00:10:09.000Z"
    },
    {
      "created": "2026-05-16T02:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible Authenticated Command Injection Inbound - Comtrend VR-3033 (CVE-2020-10173); ports=80; cc=US; asn=7018; asn_org=AT&T Enterprises, LLC",
      "id": "indicator--0f7cccb4-554b-446f-8fda-2558a73cb45e",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-05-16T02:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '107.219.80.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T02:10:10.000Z",
      "valid_until": "2026-06-17T02:10:09.000Z"
    },
    {
      "created": "2026-05-17T02:10:11.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound; ports=8080; cc=US; asn=210558; asn_org=1337 Services GmbH",
      "id": "indicator--f3a8273f-9243-44f1-a5ee-cd7ed805faf4",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-05-17T02:10:11.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '124.198.131.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T02:10:11.000Z",
      "valid_until": "2026-06-18T02:10:10.000Z"
    },
    {
      "created": "2026-05-17T07:10:11.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--862a33ee-a5c5-4179-9f3c-f77bcf056bdf",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-05-17T07:10:11.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T07:10:11.000Z",
      "valid_until": "2026-06-18T07:10:09.000Z"
    },
    {
      "created": "2026-05-18T03:10:06.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=2; categories=Attempted Administrator Privilege Gain,Web Application Attack; sigs(top)=ET SCAN JAWS Webserver Unauthenticated Shell Command Execution; ET SCAN Mirai Variant User-Agent (Inbound); ports=80; cc=PK; asn=9541; asn_org=Cyber Internet Services Pvt Ltd.",
      "id": "indicator--a7fd9448-bc82-4294-badf-4f3d47589642",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-18T03:10:06.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '67.102.7.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T03:10:06.000Z",
      "valid_until": "2026-06-19T03:10:03.000Z"
    },
    {
      "created": "2026-05-18T04:10:01.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--edf9f863-84f3-48ab-be00-7bae3adf7923",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-05-18T04:10:01.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '184.105.139.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T04:10:01.000Z",
      "valid_until": "2026-06-19T04:10:00.000Z"
    },
    {
      "created": "2026-05-18T07:10:24.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=5555; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--e016b143-4317-4988-aab0-29960d378845",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-18T07:10:24.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '121.35.170.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T07:10:24.000Z",
      "valid_until": "2026-06-19T07:10:09.000Z"
    },
    {
      "created": "2026-05-20T02:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=2; categories=Attempted Administrator Privilege Gain,Web Application Attack; sigs(top)=ET SCAN JAWS Webserver Unauthenticated Shell Command Execution; ET SCAN Mirai Variant User-Agent (Inbound); ports=80; cc=CN; asn=17622; asn_org=China Unicom Guangzhou network",
      "id": "indicator--42484ff2-d90b-42eb-a5a1-d8a5d150db02",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-20T02:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '120.85.119.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T02:10:10.000Z",
      "valid_until": "2026-06-21T02:10:09.000Z"
    },
    {
      "created": "2026-05-20T03:10:31.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=4; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT F5 TMUI RCE vulnerability CVE-2020-5902 Attempt M1; ET EXPLOIT Multiple DrayTek Products Pre-authentication Remote RCE Inbound (CVE-2020-8515) M2; ports=8080; cc=US; asn=20473; asn_org=The Constant Company, LLC",
      "id": "indicator--af5417fe-8e52-46de-9c31-51f6937d148c",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-05-20T03:10:31.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '108.61.241.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T03:10:31.000Z",
      "valid_until": "2026-06-21T03:10:09.000Z"
    },
    {
      "created": "2026-05-20T05:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=80; cc=CN; asn=17622; asn_org=China Unicom Guangzhou network",
      "id": "indicator--86a31698-0aa3-4e3f-a9bc-b2387518603d",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-20T05:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '120.85.113.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T05:10:10.000Z",
      "valid_until": "2026-06-21T05:10:09.000Z"
    },
    {
      "created": "2026-05-20T10:10:49.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=49152; cc=PK; asn=9541; asn_org=Cyber Internet Services Pvt Ltd.",
      "id": "indicator--de1ffe24-09c3-483e-9afa-ee9bd2790d3f",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-20T10:10:49.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '72.255.26.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T10:10:49.000Z",
      "valid_until": "2026-06-21T10:10:09.000Z"
    },
    {
      "created": "2026-05-21T01:10:17.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--e7e35f70-4192-4fae-98c1-82259f9fde37",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-05-21T01:10:17.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T01:10:17.000Z",
      "valid_until": "2026-06-22T01:10:16.000Z"
    },
    {
      "created": "2026-05-21T18:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=7574; cc=US; asn=7018; asn_org=AT&T Enterprises, LLC",
      "id": "indicator--4bad9962-3f05-47af-9371-d1a52b62acd4",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-21T18:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.49.178.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T18:10:10.000Z",
      "valid_until": "2026-06-22T18:10:09.000Z"
    },
    {
      "created": "2026-05-21T22:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Potentially Bad Traffic; sigs(top)=ET REMOTE_ACCESS Tunneled RDP msts Handshake; ports=55777; cc=AZ; asn=201814; asn_org=MEVSPACE sp. z o.o.",
      "id": "indicator--a55f8348-552d-479c-9577-dba47b6b07e7",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-21T22:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '109.205.211.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T22:10:10.000Z",
      "valid_until": "2026-06-22T22:10:09.000Z"
    },
    {
      "created": "2026-05-22T02:10:05.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--b5b58ac3-2946-4813-83c6-75b11d1a57f8",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-05-22T02:10:05.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T02:10:05.000Z",
      "valid_until": "2026-06-23T02:10:04.000Z"
    },
    {
      "created": "2026-05-23T00:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=7574; cc=AR; asn=266702; asn_org=MEGALINK S.R.L.",
      "id": "indicator--ac28825a-1b77-41e1-92c0-77c60a2a3129",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-23T00:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.230.66.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T00:10:10.000Z",
      "valid_until": "2026-06-24T00:10:09.000Z"
    },
    {
      "created": "2026-05-23T02:10:09.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--4cd6c3b7-4cb8-4ed7-8981-87b5da9e30c9",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-05-23T02:10:09.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T02:10:09.000Z",
      "valid_until": "2026-06-24T02:10:08.000Z"
    },
    {
      "created": "2026-05-23T07:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=80; cc=PK; asn=9541; asn_org=Cyber Internet Services Pvt Ltd.",
      "id": "indicator--834bb257-f278-45d0-a132-8f5bd347f70a",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-23T07:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '144.48.135.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T07:10:10.000Z",
      "valid_until": "2026-06-24T07:10:09.000Z"
    },
    {
      "created": "2026-05-23T15:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=49152; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--898a5adc-65e5-41c0-9225-3ae8881fee9b",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-23T15:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '60.23.220.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T15:10:10.000Z",
      "valid_until": "2026-06-24T15:10:09.000Z"
    },
    {
      "created": "2026-05-24T06:10:04.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--81fde9ef-6348-4173-8bd7-033014aa8ad1",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-05-24T06:10:04.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T06:10:04.000Z",
      "valid_until": "2026-06-25T06:10:03.000Z"
    },
    {
      "created": "2026-05-25T07:10:05.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--8147baa3-959e-427b-be0d-fd6ab972612a",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-05-25T07:10:05.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '184.105.247.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T07:10:05.000Z",
      "valid_until": "2026-06-26T07:10:04.000Z"
    },
    {
      "created": "2026-05-25T18:10:09.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=5555; cc=TW; asn=9416; asn_org=Hoshin Multimedia Center Inc.",
      "id": "indicator--4d970726-3783-442b-b42d-11e147d80c68",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-25T18:10:09.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '61.70.80.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T18:10:09.000Z",
      "valid_until": "2026-06-26T18:10:08.000Z"
    },
    {
      "created": "2026-05-28T01:10:15.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=49152; cc=PK; asn=141342; asn_org=FIBERISH PVT LTD",
      "id": "indicator--fff91c98-43f2-4fa7-b748-8f3463637c98",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-28T01:10:15.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.72.1.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T01:10:15.000Z",
      "valid_until": "2026-06-29T01:10:14.000Z"
    },
    {
      "created": "2026-05-28T04:10:09.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Web Application Attack; sigs(top)=ET SCAN JAWS Webserver Unauthenticated Shell Command Execution; ports=80; cc=AR; asn=7303; asn_org=Telecom Argentina S.A.",
      "id": "indicator--e94831b8-1a23-4434-a45d-8e043d972bd5",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-28T04:10:09.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.227.60.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T04:10:09.000Z",
      "valid_until": "2026-06-29T04:10:08.000Z"
    },
    {
      "created": "2026-05-28T04:10:09.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--3f851bec-3bcd-40a6-a634-155970c84a51",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-05-28T04:10:09.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T04:10:09.000Z",
      "valid_until": "2026-06-29T04:10:08.000Z"
    },
    {
      "created": "2026-05-28T19:10:09.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Web Application Attack; sigs(top)=ET SCAN JAWS Webserver Unauthenticated Shell Command Execution; ports=80; cc=BR; asn=267335; asn_org=MUNDIAL TELECOMUNICACAO LTDA - ME",
      "id": "indicator--5e30305b-3f57-4cee-a73c-f160f82f5837",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-28T19:10:09.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.234.3.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T19:10:09.000Z",
      "valid_until": "2026-06-29T19:10:08.000Z"
    },
    {
      "created": "2026-05-28T20:10:06.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=80; cc=PK; asn=138423; asn_org=CMPak Limited",
      "id": "indicator--0b8454ae-01fb-4741-894a-3d7f81f4aabb",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-28T20:10:06.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '223.123.42.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T20:10:06.000Z",
      "valid_until": "2026-06-29T20:10:04.000Z"
    },
    {
      "created": "2026-05-29T00:10:12.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=4; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound; ports=8080; cc=US; asn=210558; asn_org=1337 Services GmbH",
      "id": "indicator--af36fa18-2cb4-4b79-969d-9421b037ffb9",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-05-29T00:10:12.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '124.198.131.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T00:10:12.000Z",
      "valid_until": "2026-06-30T00:10:09.000Z"
    },
    {
      "created": "2026-05-29T06:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Web Application Attack; sigs(top)=ET SCAN JAWS Webserver Unauthenticated Shell Command Execution; ports=80; cc=CG; asn=37451; asn_org=CongoTelecom",
      "id": "indicator--62d072ea-5497-4aec-9eb5-9ba15c0d700a",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-29T06:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '102.129.75.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T06:10:10.000Z",
      "valid_until": "2026-06-30T06:10:09.000Z"
    },
    {
      "created": "2026-05-29T07:10:11.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--6450c4a5-a706-463a-bd33-2a060ab187b2",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-05-29T07:10:11.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T07:10:11.000Z",
      "valid_until": "2026-06-30T07:10:08.000Z"
    },
    {
      "created": "2026-05-29T17:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Web Application Attack; sigs(top)=ET SCAN JAWS Webserver Unauthenticated Shell Command Execution; ports=80; cc=PE; asn=273976; asn_org=FICOM TELECOMUNICACIONES S.A.C.",
      "id": "indicator--e6882679-8b95-450c-957d-67fe3ea416e6",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-29T17:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '190.93.224.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T17:10:10.000Z",
      "valid_until": "2026-06-30T17:10:09.000Z"
    },
    {
      "created": "2026-05-29T17:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=80; cc=PK; asn=9541; asn_org=Cyber Internet Services Pvt Ltd.",
      "id": "indicator--ba0437ce-a3c8-4d7d-b981-2faeeb202612",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-29T17:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '206.135.161.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T17:10:10.000Z",
      "valid_until": "2026-06-30T17:10:09.000Z"
    },
    {
      "created": "2026-05-29T22:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=5555; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--7b8de1bb-b42a-4e94-9f10-9c2b0088c215",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-29T22:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '119.156.31.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T22:10:10.000Z",
      "valid_until": "2026-06-30T22:10:09.000Z"
    },
    {
      "created": "2026-05-29T23:10:01.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Web Application Attack; sigs(top)=ET SCAN JAWS Webserver Unauthenticated Shell Command Execution; ports=80; cc=GA; asn=36924; asn_org=GVA-Canalbox",
      "id": "indicator--7eb1ecc4-ddd4-463e-a729-6c6b17e0be6d",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-29T23:10:01.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '102.142.31.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T23:10:01.000Z",
      "valid_until": "2026-06-30T23:10:01.000Z"
    },
    {
      "created": "2026-05-31T00:10:09.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--e58a0a38-6d59-43e7-9b5f-ec3fdc75c00c",
      "labels": [
        "malware_hosting"
      ],
      "modified": "2026-05-31T00:10:09.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T00:10:09.000Z",
      "valid_until": "2026-07-02T00:10:08.000Z"
    },
    {
      "created": "2026-05-31T04:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=5555; cc=PK; asn=9541; asn_org=Cyber Internet Services Pvt Ltd.",
      "id": "indicator--787f18a0-6860-4bc1-af1a-12cdd210f36b",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-31T04:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '72.255.19.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T04:10:10.000Z",
      "valid_until": "2026-07-02T04:10:08.000Z"
    },
    {
      "created": "2026-05-31T05:10:04.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=8080; cc=PK; asn=138423; asn_org=CMPak Limited",
      "id": "indicator--683308a0-a8b2-4f70-9af8-30f07c866419",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-31T05:10:04.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '223.123.125.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T05:10:04.000Z",
      "valid_until": "2026-07-02T05:10:03.000Z"
    },
    {
      "created": "2026-05-31T13:10:10.000Z",
      "description": "High & Medium Suricata IDS Source / seen in Suricata IDS alerts; events=1; categories=Attempted Administrator Privilege Gain; sigs(top)=ET SCAN Mirai Variant User-Agent (Inbound); ports=7574; cc=IR; asn=58224; asn_org=Iran Telecommunication Company PJS",
      "id": "indicator--60a6875b-5756-4f4f-bb27-76cfb4bee460",
      "labels": [
        "scanning_host"
      ],
      "modified": "2026-05-31T13:10:10.000Z",
      "name": "OTX pulse_name=Suricata \u2192 High & Medium Alert IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '2.181.57.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T13:10:10.000Z",
      "valid_until": "2026-07-02T13:10:09.000Z"
    }
  ],
  "spec_version": "2.1",
  "type": "bundle",
  "x_nadsec_enrichment": {
    "enriched_at": "2026-05-31T23:45:01.357522+00:00",
    "sensor": "suricata",
    "sensor_type": "network_ids",
    "month": "2026-05",
    "ip_count": 74,
    "total_alerts": 296055
  },
  "x_nadsec_ip_context": {
    "45.148.9.200": {
      "alert_count": 274345,
      "first_seen": "2026-05-02T02:10:50.577Z",
      "last_seen": "2026-05-31T14:11:35.676Z",
      "signatures": [
        "GPL VOIP SIP INVITE message flooding",
        "GPL ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited"
      ],
      "categories": [
        "Attempted Denial of Service",
        "Misc activity"
      ],
      "severities": [
        2,
        3
      ],
      "dest_ports": [
        5060
      ],
      "protocols": [
        "UDP",
        "ICMP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 67.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 538102,
        "days_active_30d": 30,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T02:10:50.577000+00:00",
        "last_seen_30d": "2026-05-31T14:11:35.676000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 274345,
        "Sentrypeer": 263757
      }
    },
    "109.205.211.99": {
      "alert_count": 18054,
      "first_seen": "2026-05-19T22:43:28.616Z",
      "last_seen": "2026-05-26T10:00:16.974Z",
      "signatures": [
        "SURICATA Applayer Detect protocol only one direction",
        "SURICATA HTTP request missing protocol",
        "ET INFO SSH session in progress on Expected Port",
        "SURICATA SSH invalid banner",
        "ET REMOTE_ACCESS Tunneled RDP msts Handshake",
        "SURICATA STREAM spurious retransmission"
      ],
      "categories": [
        "Generic Protocol Command Decode",
        "Misc activity",
        "Potentially Bad Traffic"
      ],
      "severities": [
        3,
        2
      ],
      "dest_ports": [
        80,
        22,
        21,
        25,
        143,
        443,
        1982,
        2020,
        995,
        1433
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Azerbaijan",
      "country_code": "AZ",
      "city": null,
      "asn": 201814,
      "as_org": "MEVSPACE sp. z o.o.",
      "threat_score": 68.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 6.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 34104,
        "days_active_30d": 8,
        "ports_targeted_30d": 84,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-05-19T22:42:19+00:00",
        "last_seen_30d": "2026-05-26T10:00:16.974000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 18054,
        "Honeytrap": 13443,
        "Cowrie": 1008,
        "Dionaea": 803,
        "Adbhoney": 400,
        "ConPot": 396
      }
    },
    "108.61.241.200": {
      "alert_count": 1867,
      "first_seen": "2026-05-19T13:29:24.835Z",
      "last_seen": "2026-05-20T03:51:13.607Z",
      "signatures": [
        "ET EXPLOIT F5 TMUI RCE vulnerability CVE-2020-5902 Attempt M1",
        "SURICATA HTTP Request unrecognized authorization method",
        "ET EXPLOIT Multiple DrayTek Products Pre-authentication Remote RCE Inbound (CVE-2020-8515) M2",
        "ET INFO Cleartext WordPress Login",
        "SURICATA Applayer Mismatch protocol both directions",
        "SURICATA HTTP Host header invalid",
        "SURICATA HTTP Host part of URI is invalid",
        "SURICATA HTTP Request excessive header repetition",
        "SURICATA HTTP Unexpected Request body"
      ],
      "categories": [
        "Generic Protocol Command Decode",
        "Attempted Administrator Privilege Gain",
        "Potential Corporate Privacy Violation"
      ],
      "severities": [
        3,
        1
      ],
      "dest_ports": [
        8080,
        5060,
        7001
      ],
      "protocols": [
        "TCP",
        "UDP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 20473,
      "as_org": "The Constant Company, LLC",
      "threat_score": 37.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 1.7,
        "diversity": 8,
        "spread": 20,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 1876,
        "days_active_30d": 2,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-19T13:29:24.614000+00:00",
        "last_seen_30d": "2026-05-20T03:51:13.607000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1867,
        "Honeytrap": 3,
        "Sentrypeer": 3,
        "Wordpot": 3
      }
    },
    "124.198.131.185": {
      "alert_count": 429,
      "first_seen": "2026-05-02T01:33:17.364Z",
      "last_seen": "2026-05-17T16:16:40.374Z",
      "signatures": [
        "ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        3000,
        61616,
        3001,
        8088,
        8080,
        8265,
        80,
        2375,
        500,
        6082
      ],
      "protocols": [
        "TCP",
        "UDP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 210558,
      "as_org": "1337 Services GmbH",
      "threat_score": 43.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.6,
        "persistence": 13.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 570,
        "days_active_30d": 16,
        "ports_targeted_30d": 14,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T01:33:17.364000+00:00",
        "last_seen_30d": "2026-05-17T16:16:40.374000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Suricata": 429,
        "Honeytrap": 89,
        "Honeyaml": 49,
        "Tanner": 3
      }
    },
    "124.198.131.22": {
      "alert_count": 404,
      "first_seen": "2026-05-22T01:11:11.155Z",
      "last_seen": "2026-05-29T12:09:45.529Z",
      "signatures": [
        "ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        8088,
        3000,
        61616,
        8080,
        3001,
        9999,
        1881,
        9001,
        9002,
        500
      ],
      "protocols": [
        "TCP",
        "UDP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 210558,
      "as_org": "1337 Services GmbH",
      "threat_score": 64.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 27.1,
        "persistence": 6.7,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 513,
        "days_active_30d": 8,
        "ports_targeted_30d": 13,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-22T01:11:11.155000+00:00",
        "last_seen_30d": "2026-05-29T12:09:45.529000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 404,
        "Honeytrap": 65,
        "Honeyaml": 44
      }
    },
    "119.160.215.50": {
      "alert_count": 88,
      "first_seen": "2026-05-05T07:41:00.025Z",
      "last_seen": "2026-05-27T22:00:44.055Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)",
        "ET SCAN JAWS Webserver Unauthenticated Shell Command Execution"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Web Application Attack"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        23,
        80,
        60001,
        2323
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Gujranwala",
      "asn": 137047,
      "as_org": "TELECOMMUNICATION AND TECHNOLOGY MASTERS PVT. LIMITED",
      "threat_score": 57.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 23.8,
        "persistence": 19.2,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 239,
        "days_active_30d": 23,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-05T07:41:00.025000+00:00",
        "last_seen_30d": "2026-05-27T22:00:44.055000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 150,
        "Suricata": 88,
        "Honeytrap": 1
      }
    },
    "202.112.237.233": {
      "alert_count": 88,
      "first_seen": "2026-05-02T01:26:51.222Z",
      "last_seen": "2026-05-31T23:27:36.393Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free",
        "SURICATA ICMPv4 invalid checksum"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Generic Protocol Command Decode"
      ],
      "severities": [
        1,
        3
      ],
      "dest_ports": [
        443,
        80,
        22,
        53
      ],
      "protocols": [
        "TCP",
        "IP-in-IP",
        "ICMP"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4538,
      "as_org": "China Education and Research Network Center",
      "threat_score": 57.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.4,
        "persistence": 25,
        "diversity": 8,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 88,
        "days_active_30d": 30,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T01:26:51.222000+00:00",
        "last_seen_30d": "2026-05-31T23:27:36.393000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 88
      }
    },
    "184.105.247.247": {
      "alert_count": 57,
      "first_seen": "2026-05-03T00:34:42.648Z",
      "last_seen": "2026-05-31T11:04:42.729Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free",
        "ET INFO SSH session in progress on Unusual Port",
        "SURICATA STREAM Packet with broken ack"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Generic Protocol Command Decode",
        "Misc activity"
      ],
      "severities": [
        3,
        1
      ],
      "dest_ports": [
        1337,
        2404,
        22122,
        25,
        80,
        389,
        6080,
        8081,
        86,
        88
      ],
      "protocols": [
        "TCP",
        "UDP",
        "IP-in-IP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 77.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 17.9,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 62,
        "days_active_30d": 29,
        "ports_targeted_30d": 44,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-03T00:34:42.648000+00:00",
        "last_seen_30d": "2026-05-31T11:04:42.729000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 57,
        "ConPot": 3,
        "Honeytrap": 2
      }
    },
    "119.156.31.177": {
      "alert_count": 56,
      "first_seen": "2026-05-21T11:17:16.008Z",
      "last_seen": "2026-05-29T22:05:48.391Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        23,
        5555
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Gujrat",
      "asn": 17557,
      "as_org": "Pakistan Telecommunication Company Limited",
      "threat_score": 45.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.0,
        "persistence": 7.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 158,
        "days_active_30d": 9,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-21T11:16:11.966000+00:00",
        "last_seen_30d": "2026-05-29T22:05:48.391000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 100,
        "Suricata": 56,
        "Adbhoney": 2
      }
    },
    "65.49.1.145": {
      "alert_count": 30,
      "first_seen": "2026-05-03T11:55:33.183Z",
      "last_seen": "2026-05-31T05:41:54.964Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free",
        "ET INFO SSH session in progress on Unusual Port"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Misc activity"
      ],
      "severities": [
        1,
        3
      ],
      "dest_ports": [
        443,
        57722,
        8081,
        9200,
        12654,
        1080,
        2087,
        3333,
        4081,
        4786
      ],
      "protocols": [
        "TCP",
        "IP-in-IP",
        "UDP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 80.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 15.9,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 39,
        "days_active_30d": 29,
        "ports_targeted_30d": 18,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-03T11:55:33.183000+00:00",
        "last_seen_30d": "2026-05-31T05:41:54.964000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 30,
        "Honeytrap": 6,
        "H0neytr4p": 2,
        "ElasticPot": 1
      }
    },
    "64.62.156.190": {
      "alert_count": 28,
      "first_seen": "2026-05-02T06:33:51.466Z",
      "last_seen": "2026-05-31T04:21:52.669Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        6516,
        8080,
        8443,
        25,
        82,
        445,
        1000,
        1311,
        4081,
        5000
      ],
      "protocols": [
        "TCP",
        "IP-in-IP",
        "UDP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 70.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 30,
        "ports_targeted_30d": 23,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T06:33:51.466000+00:00",
        "last_seen_30d": "2026-05-31T04:21:52.669000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 28,
        "Honeytrap": 6
      }
    },
    "64.62.156.176": {
      "alert_count": 27,
      "first_seen": "2026-05-02T01:47:15.399Z",
      "last_seen": "2026-05-29T10:54:30.689Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free",
        "ET INFO SSH session in progress on Unusual Port"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Misc activity"
      ],
      "severities": [
        1,
        3
      ],
      "dest_ports": [
        1337,
        2404,
        85,
        87,
        1962,
        2001,
        4080,
        4081,
        4848,
        5903
      ],
      "protocols": [
        "TCP",
        "IP-in-IP",
        "UDP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 68.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.4,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 28,
        "ports_targeted_30d": 22,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T01:47:15.399000+00:00",
        "last_seen_30d": "2026-05-29T10:54:30.689000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 27,
        "Honeytrap": 5,
        "ConPot": 3
      }
    },
    "65.49.1.125": {
      "alert_count": 26,
      "first_seen": "2026-05-05T11:04:56.877Z",
      "last_seen": "2026-05-31T00:13:08.965Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        443,
        5080,
        9200,
        873,
        1962,
        2087,
        3389,
        4444,
        6379,
        8001
      ],
      "protocols": [
        "TCP",
        "IP-in-IP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 77.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.3,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 27,
        "ports_targeted_30d": 17,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-05T11:04:56.877000+00:00",
        "last_seen_30d": "2026-05-31T00:13:08.965000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 26,
        "Honeytrap": 6,
        "ElasticPot": 1,
        "H0neytr4p": 1
      }
    },
    "65.49.1.188": {
      "alert_count": 26,
      "first_seen": "2026-05-02T07:59:39.130Z",
      "last_seen": "2026-05-31T09:36:04.786Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        443,
        9200,
        110,
        389,
        1080,
        1801,
        4118,
        5080,
        6379,
        7047
      ],
      "protocols": [
        "TCP",
        "IP-in-IP",
        "UDP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 74.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 30,
        "ports_targeted_30d": 20,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T07:59:39.130000+00:00",
        "last_seen_30d": "2026-05-31T09:36:04.786000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 26,
        "Honeytrap": 3,
        "H0neytr4p": 2
      }
    },
    "65.49.1.196": {
      "alert_count": 26,
      "first_seen": "2026-05-02T11:52:40.684Z",
      "last_seen": "2026-05-31T15:00:34.780Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        443,
        4443,
        7000,
        8443,
        81,
        88,
        403,
        500,
        1080,
        4444
      ],
      "protocols": [
        "TCP",
        "IP-in-IP",
        "UDP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 79.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 30,
        "ports_targeted_30d": 18,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-02T11:52:40.684000+00:00",
        "last_seen_30d": "2026-05-31T15:00:34.780000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 26,
        "Ciscoasa": 1,
        "CitrixHoneypot": 1,
        "Honeytrap": 1
      }
    },
    "64.62.197.214": {
      "alert_count": 24,
      "first_seen": "2026-05-02T04:42:09.032Z",
      "last_seen": "2026-05-25T08:55:21.265Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free",
        "ET INFO SSH session in progress on Unusual Port"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Misc activity"
      ],
      "severities": [
        1,
        3
      ],
      "dest_ports": [
        1337,
        500,
        82,
        1434,
        2152,
        2600,
        3389,
        4081,
        5000,
        8001
      ],
      "protocols": [
        "TCP",
        "UDP",
        "IP-in-IP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 51.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.1,
        "persistence": 20.0,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 26,
        "days_active_30d": 24,
        "ports_targeted_30d": 19,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T04:42:09.032000+00:00",
        "last_seen_30d": "2026-05-25T08:55:21.265000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 24,
        "Honeytrap": 2
      }
    },
    "64.62.156.228": {
      "alert_count": 22,
      "first_seen": "2026-05-05T07:43:13.007Z",
      "last_seen": "2026-05-31T11:25:57.674Z",
      "signatures": [],
      "categories": [],
      "severities": [],
      "dest_ports": [
        443,
        22,
        830,
        2455,
        3001,
        4433,
        5804,
        5985,
        6081,
        7000
      ],
      "protocols": [
        "TCP",
        "UDP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 67.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.5,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 27,
        "ports_targeted_30d": 21,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T07:43:13.007000+00:00",
        "last_seen_30d": "2026-05-31T11:25:57.674000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 22,
        "Honeytrap": 6
      }
    },
    "65.49.1.134": {
      "alert_count": 22,
      "first_seen": "2026-05-03T12:28:42.897Z",
      "last_seen": "2026-05-31T03:51:59.008Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        9200,
        443,
        123,
        1080,
        2000,
        2082,
        4444,
        5803,
        6080,
        9090
      ],
      "protocols": [
        "TCP",
        "IP-in-IP",
        "UDP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 78.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.1,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 26,
        "days_active_30d": 29,
        "ports_targeted_30d": 16,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-05-03T12:28:42.897000+00:00",
        "last_seen_30d": "2026-05-31T03:51:59.008000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 22,
        "Honeytrap": 2,
        "ElasticPot": 1,
        "H0neytr4p": 1
      }
    },
    "216.218.206.71": {
      "alert_count": 21,
      "first_seen": "2026-05-02T00:40:01.676Z",
      "last_seen": "2026-05-29T11:31:58.167Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        443,
        500,
        8443,
        1883,
        2101,
        4646,
        5443,
        5672,
        5800,
        6025
      ],
      "protocols": [
        "TCP",
        "IP-in-IP",
        "UDP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Cazadero",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 62.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 13.4,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 28,
        "ports_targeted_30d": 14,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T00:40:01.676000+00:00",
        "last_seen_30d": "2026-05-29T11:31:58.167000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 21,
        "Honeytrap": 1
      }
    },
    "64.62.197.127": {
      "alert_count": 20,
      "first_seen": "2026-05-02T04:23:53.133Z",
      "last_seen": "2026-05-29T00:06:16.366Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free",
        "ET INFO SSH session in progress on Expected Port"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Misc activity"
      ],
      "severities": [
        1,
        3
      ],
      "dest_ports": [
        22,
        500,
        1080,
        1311,
        1801,
        2083,
        3283,
        4444,
        6081,
        6516
      ],
      "protocols": [
        "TCP",
        "IP-in-IP",
        "UDP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 67.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.3,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 28,
        "ports_targeted_30d": 16,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T04:23:53.133000+00:00",
        "last_seen_30d": "2026-05-29T00:06:16.366000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 20,
        "Cowrie": 4,
        "Honeytrap": 3
      }
    },
    "65.49.1.148": {
      "alert_count": 20,
      "first_seen": "2026-05-03T02:13:06.837Z",
      "last_seen": "2026-05-31T03:38:56.701Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        443,
        25,
        83,
        123,
        995,
        1337,
        2001,
        3333,
        3389,
        4646
      ],
      "protocols": [
        "TCP",
        "IP-in-IP",
        "UDP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 67.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 13.6,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 29,
        "ports_targeted_30d": 17,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T02:13:06.837000+00:00",
        "last_seen_30d": "2026-05-31T03:38:56.701000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 20,
        "Honeytrap": 3
      }
    },
    "64.62.156.29": {
      "alert_count": 19,
      "first_seen": "2026-05-04T02:42:08.484Z",
      "last_seen": "2026-05-30T04:50:14.308Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        8080,
        10074,
        22,
        37,
        85,
        135,
        1962,
        2101,
        3333,
        3389
      ],
      "protocols": [
        "TCP",
        "UDP",
        "IP-in-IP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 63.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 13.0,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 27,
        "ports_targeted_30d": 14,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T02:42:08.484000+00:00",
        "last_seen_30d": "2026-05-30T04:50:14.308000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 19,
        "Honeytrap": 1
      }
    },
    "64.62.197.178": {
      "alert_count": 19,
      "first_seen": "2026-05-03T12:27:42.127Z",
      "last_seen": "2026-05-31T15:06:42.117Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        623,
        1337,
        1521,
        2002,
        2095,
        2096,
        3333,
        5555,
        5988,
        7001
      ],
      "protocols": [
        "TCP",
        "IP-in-IP",
        "UDP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 67.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 13.2,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 29,
        "ports_targeted_30d": 17,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-03T12:27:42.127000+00:00",
        "last_seen_30d": "2026-05-31T15:06:42.117000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 19,
        "Honeytrap": 2
      }
    },
    "216.218.206.109": {
      "alert_count": 18,
      "first_seen": "2026-05-06T12:02:06.724Z",
      "last_seen": "2026-05-31T00:25:15.501Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free",
        "ET INFO SSH session in progress on Unusual Port"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Misc activity"
      ],
      "severities": [
        1,
        3
      ],
      "dest_ports": [
        8080,
        53282,
        8443,
        53,
        8899,
        9090,
        10001,
        13046,
        20020,
        23856
      ],
      "protocols": [
        "TCP",
        "UDP",
        "IP-in-IP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Cazadero",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 69.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 13.0,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 26,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-06T12:02:06.724000+00:00",
        "last_seen_30d": "2026-05-31T00:25:15.501000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 18,
        "Ciscoasa": 1,
        "Honeytrap": 1
      }
    },
    "216.218.206.92": {
      "alert_count": 17,
      "first_seen": "2026-05-03T14:40:37.433Z",
      "last_seen": "2026-05-29T03:36:46.310Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free",
        "ET INFO SSH session in progress on Unusual Port"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Misc activity"
      ],
      "severities": [
        1,
        3
      ],
      "dest_ports": [
        53282,
        179,
        1337,
        2002,
        2031,
        5094,
        8001,
        8123,
        8888,
        9100
      ],
      "protocols": [
        "TCP",
        "IP-in-IP",
        "UDP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Cazadero",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 65.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 12.8,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 27,
        "ports_targeted_30d": 13,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-03T14:40:36+00:00",
        "last_seen_30d": "2026-05-29T03:36:46.310000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 17,
        "Honeytrap": 1,
        "Miniprint": 1
      }
    },
    "144.48.135.208": {
      "alert_count": 16,
      "first_seen": "2026-05-14T21:40:12.793Z",
      "last_seen": "2026-05-23T07:00:39.474Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        23,
        80
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Sialkot",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 28.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.8,
        "persistence": 8.3,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 10,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-14T21:39:05.323000+00:00",
        "last_seen_30d": "2026-05-23T07:00:39.474000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 22,
        "Suricata": 16
      }
    },
    "184.105.247.223": {
      "alert_count": 16,
      "first_seen": "2026-05-02T01:49:21.874Z",
      "last_seen": "2026-05-30T11:23:16.193Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        11,
        102,
        500,
        1521,
        1883,
        5555,
        6025,
        6081,
        9090,
        9642
      ],
      "protocols": [
        "TCP",
        "IP-in-IP",
        "UDP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 64.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 12.6,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 29,
        "ports_targeted_30d": 14,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T01:49:21.874000+00:00",
        "last_seen_30d": "2026-05-30T11:23:16.193000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 16,
        "Honeytrap": 2
      }
    },
    "65.49.20.121": {
      "alert_count": 16,
      "first_seen": "2026-05-04T04:23:52.663Z",
      "last_seen": "2026-05-31T11:13:52.077Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        69,
        82,
        1098,
        1883,
        4786,
        5002,
        7071,
        8060,
        8090,
        9600
      ],
      "protocols": [
        "TCP",
        "UDP",
        "IP-in-IP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 65.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 12.6,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 28,
        "ports_targeted_30d": 13,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-04T04:22:43+00:00",
        "last_seen_30d": "2026-05-31T11:13:52.077000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 16,
        "Honeytrap": 2
      }
    },
    "184.105.139.90": {
      "alert_count": 15,
      "first_seen": "2026-05-06T09:32:48.502Z",
      "last_seen": "2026-05-29T00:10:59.030Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        69,
        3389,
        5007,
        6081,
        7047,
        8030,
        9001,
        9192,
        12443,
        30005
      ],
      "protocols": [
        "TCP",
        "IP-in-IP",
        "UDP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 58.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.3,
        "persistence": 20.0,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 24,
        "ports_targeted_30d": 12,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T09:32:48.502000+00:00",
        "last_seen_30d": "2026-05-29T00:10:59.030000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 15,
        "Honeytrap": 2
      }
    },
    "184.105.139.97": {
      "alert_count": 14,
      "first_seen": "2026-05-02T08:25:45.944Z",
      "last_seen": "2026-05-26T12:07:28.959Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        5002,
        65422,
        89,
        4081,
        4433,
        5988,
        7443,
        8001,
        8088,
        23756
      ],
      "protocols": [
        "TCP",
        "IP-in-IP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 52.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.0,
        "persistence": 20.8,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 25,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T08:25:45.944000+00:00",
        "last_seen_30d": "2026-05-26T12:07:28.959000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 14,
        "Honeytrap": 2
      }
    },
    "184.105.247.210": {
      "alert_count": 14,
      "first_seen": "2026-05-07T06:35:01.229Z",
      "last_seen": "2026-05-31T00:40:02.340Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        9090,
        1521,
        2600,
        3000,
        8006,
        8531,
        9001,
        12346,
        20020,
        23956
      ],
      "protocols": [
        "TCP",
        "IP-in-IP",
        "UDP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 62.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 11.8,
        "persistence": 20.8,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 25,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T06:35:01.229000+00:00",
        "last_seen_30d": "2026-05-31T00:40:02.340000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 14,
        "Honeytrap": 1
      }
    },
    "216.218.206.101": {
      "alert_count": 14,
      "first_seen": "2026-05-02T06:43:19.748Z",
      "last_seen": "2026-05-31T12:50:33.652Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        2404,
        8443,
        444,
        801,
        4840,
        6080,
        8883,
        27017,
        51200,
        53282
      ],
      "protocols": [
        "TCP",
        "IP-in-IP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Cazadero",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 67.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 12.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 30,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T06:43:19.748000+00:00",
        "last_seen_30d": "2026-05-31T12:50:33.652000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 14,
        "ConPot": 3
      }
    },
    "62.171.169.207": {
      "alert_count": 13,
      "first_seen": "2026-05-02T18:32:58.122Z",
      "last_seen": "2026-05-06T18:36:35.776Z",
      "signatures": [
        "ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        17000,
        55555,
        23,
        8080
      ],
      "protocols": [
        "TCP"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 4.2,
        "diversity": 8,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 5,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-02T18:32:58.122000+00:00",
        "last_seen_30d": "2026-05-06T18:36:35.776000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 13,
        "Honeytrap": 3
      }
    },
    "74.82.47.41": {
      "alert_count": 12,
      "first_seen": "2026-05-08T08:46:52.368Z",
      "last_seen": "2026-05-31T03:44:07.235Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        102,
        2082,
        2121,
        4118,
        7900,
        9001,
        10443,
        12446,
        47808
      ],
      "protocols": [
        "TCP",
        "IP-in-IP",
        "UDP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Gunnison",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 53.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 10.8,
        "persistence": 20.0,
        "diversity": 18,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 24,
        "ports_targeted_30d": 9,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-08T08:46:52.368000+00:00",
        "last_seen_30d": "2026-05-31T03:44:07.235000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 12
      }
    },
    "74.82.47.58": {
      "alert_count": 8,
      "first_seen": "2026-05-03T08:03:20.722Z",
      "last_seen": "2026-05-28T04:31:56.274Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        830,
        6443,
        8888,
        10514,
        12646,
        31337
      ],
      "protocols": [
        "TCP",
        "IP-in-IP",
        "UDP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Gunnison",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 42.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 9.0,
        "persistence": 21.7,
        "diversity": 12,
        "spread": 5,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 26,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-03T08:03:20.722000+00:00",
        "last_seen_30d": "2026-05-28T04:31:56.274000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8
      }
    },
    "45.230.66.121": {
      "alert_count": 7,
      "first_seen": "2026-05-02T05:22:36.656Z",
      "last_seen": "2026-05-22T23:10:09.973Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        7574,
        81,
        1027
      ],
      "protocols": [
        "TCP",
        "UDP"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Timb\u00faes",
      "asn": 266702,
      "as_org": "MEGALINK S.R.L.",
      "threat_score": 33.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 17.5,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 21,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-05-02T05:22:34.282000+00:00",
        "last_seen_30d": "2026-05-22T23:10:09.973000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Dionaea": 1,
        "Honeytrap": 1
      }
    },
    "60.23.220.86": {
      "alert_count": 6,
      "first_seen": "2026-05-23T14:46:32.198Z",
      "last_seen": "2026-05-23T14:46:32.203Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)",
        "SURICATA HTTP Unexpected Request body"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Generic Protocol Command Decode"
      ],
      "severities": [
        1,
        3
      ],
      "dest_ports": [
        49152
      ],
      "protocols": [
        "TCP"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 15.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-23T14:45:20+00:00",
        "last_seen_30d": "2026-05-23T14:46:32.203000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Honeytrap": 1
      }
    },
    "72.255.26.44": {
      "alert_count": 6,
      "first_seen": "2026-05-20T09:15:37.463Z",
      "last_seen": "2026-05-20T09:15:37.467Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)",
        "SURICATA HTTP Unexpected Request body"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Generic Protocol Command Decode"
      ],
      "severities": [
        1,
        3
      ],
      "dest_ports": [
        49152
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T09:14:33+00:00",
        "last_seen_30d": "2026-05-20T09:15:37.467000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Honeytrap": 1
      }
    },
    "102.129.75.56": {
      "alert_count": 5,
      "first_seen": "2026-05-29T05:43:35.635Z",
      "last_seen": "2026-05-29T05:44:41.086Z",
      "signatures": [
        "ET SCAN JAWS Webserver Unauthenticated Shell Command Execution"
      ],
      "categories": [
        "Web Application Attack"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        80
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Congo Republic",
      "country_code": "CG",
      "city": "Brazzaville",
      "asn": 37451,
      "as_org": "CongoTelecom",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-29T05:43:35.635000+00:00",
        "last_seen_30d": "2026-05-29T05:44:41.086000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5
      }
    },
    "102.142.31.15": {
      "alert_count": 5,
      "first_seen": "2026-05-29T22:54:37.071Z",
      "last_seen": "2026-05-29T22:56:30.102Z",
      "signatures": [
        "ET SCAN JAWS Webserver Unauthenticated Shell Command Execution"
      ],
      "categories": [
        "Web Application Attack"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        80
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Gabon",
      "country_code": "GA",
      "city": "Port-Gentil",
      "asn": 36924,
      "as_org": "GVA-Canalbox",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-29T22:54:37.071000+00:00",
        "last_seen_30d": "2026-05-29T22:56:30.102000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5
      }
    },
    "103.72.1.179": {
      "alert_count": 5,
      "first_seen": "2026-05-28T00:15:07.344Z",
      "last_seen": "2026-05-28T00:16:25.678Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)",
        "SURICATA HTTP Unexpected Request body"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Generic Protocol Command Decode"
      ],
      "severities": [
        1,
        3
      ],
      "dest_ports": [
        49152
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 141342,
      "as_org": "FIBERISH PVT LTD",
      "threat_score": 18.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-28T00:15:05+00:00",
        "last_seen_30d": "2026-05-28T00:16:25.678000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Honeytrap": 1
      }
    },
    "107.219.80.58": {
      "alert_count": 5,
      "first_seen": "2026-05-16T01:53:46.663Z",
      "last_seen": "2026-05-16T01:54:55.697Z",
      "signatures": [
        "ET EXPLOIT Possible Authenticated Command Injection Inbound - Comtrend VR-3033 (CVE-2020-10173)",
        "SURICATA HTTP missing Host header"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Generic Protocol Command Decode"
      ],
      "severities": [
        1,
        3
      ],
      "dest_ports": [
        80
      ],
      "protocols": [
        "TCP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Knoxville",
      "asn": 7018,
      "as_org": "AT&T Enterprises, LLC",
      "threat_score": 7.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-16T01:53:46.663000+00:00",
        "last_seen_30d": "2026-05-16T01:54:55.697000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5
      }
    },
    "120.85.113.113": {
      "alert_count": 5,
      "first_seen": "2026-05-12T22:47:38.209Z",
      "last_seen": "2026-05-12T22:48:39.055Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        8080
      ],
      "protocols": [
        "TCP"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 17622,
      "as_org": "China Unicom Guangzhou network",
      "threat_score": 5.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-12T22:47:38.209000+00:00",
        "last_seen_30d": "2026-05-12T22:48:39.055000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5
      }
    },
    "190.227.60.47": {
      "alert_count": 5,
      "first_seen": "2026-05-28T04:07:51.539Z",
      "last_seen": "2026-05-28T04:08:59.721Z",
      "signatures": [
        "ET SCAN JAWS Webserver Unauthenticated Shell Command Execution"
      ],
      "categories": [
        "Web Application Attack"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        80
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Jesus Maria",
      "asn": 7303,
      "as_org": "Telecom Argentina S.A.",
      "threat_score": 13.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-28T04:07:51.539000+00:00",
        "last_seen_30d": "2026-05-28T04:08:59.721000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5
      }
    },
    "190.93.224.67": {
      "alert_count": 5,
      "first_seen": "2026-05-29T16:38:23.033Z",
      "last_seen": "2026-05-29T16:39:32.433Z",
      "signatures": [
        "ET SCAN JAWS Webserver Unauthenticated Shell Command Execution"
      ],
      "categories": [
        "Web Application Attack"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        80
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Peru",
      "country_code": "PE",
      "city": null,
      "asn": 273976,
      "as_org": "FICOM TELECOMUNICACIONES S.A.C.",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-29T16:38:23.033000+00:00",
        "last_seen_30d": "2026-05-29T16:39:32.433000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5
      }
    },
    "223.123.125.13": {
      "alert_count": 5,
      "first_seen": "2026-05-31T04:12:15.950Z",
      "last_seen": "2026-05-31T04:13:25.953Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        8080
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Islamabad",
      "asn": 138423,
      "as_org": "CMPak Limited",
      "threat_score": 14.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-31T04:12:15.950000+00:00",
        "last_seen_30d": "2026-05-31T04:13:25.953000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5
      }
    },
    "223.123.42.232": {
      "alert_count": 5,
      "first_seen": "2026-05-26T06:45:05.683Z",
      "last_seen": "2026-05-28T19:41:01.291Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        80,
        23
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Islamabad",
      "asn": 138423,
      "as_org": "CMPak Limited",
      "threat_score": 16.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 2.5,
        "diversity": 4,
        "spread": 5,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 3,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-26T06:45:05.683000+00:00",
        "last_seen_30d": "2026-05-28T19:41:01.291000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5
      }
    },
    "24.182.9.70": {
      "alert_count": 5,
      "first_seen": "2026-05-02T22:44:44.062Z",
      "last_seen": "2026-05-02T22:45:51.274Z",
      "signatures": [
        "ET EXPLOIT Possible Authenticated Command Injection Inbound - Comtrend VR-3033 (CVE-2020-10173)",
        "SURICATA HTTP missing Host header"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Generic Protocol Command Decode"
      ],
      "severities": [
        1,
        3
      ],
      "dest_ports": [
        80
      ],
      "protocols": [
        "TCP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hesperia",
      "asn": 20115,
      "as_org": "Charter Communications LLC",
      "threat_score": 1.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-02T22:44:44.062000+00:00",
        "last_seen_30d": "2026-05-02T22:45:51.274000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5
      }
    },
    "72.255.19.177": {
      "alert_count": 5,
      "first_seen": "2026-05-26T11:21:35.949Z",
      "last_seen": "2026-05-31T03:28:26.669Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        5555,
        23
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 27.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 8.5,
        "persistence": 5.0,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 6,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-26T11:21:35.949000+00:00",
        "last_seen_30d": "2026-05-31T03:28:26.669000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Adbhoney": 2
      }
    },
    "103.176.16.219": {
      "alert_count": 4,
      "first_seen": "2026-05-10T12:17:48.623Z",
      "last_seen": "2026-05-10T12:27:56.256Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        5555
      ],
      "protocols": [
        "TCP"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 135687,
      "as_org": "Qwistel Network Service Private Limited",
      "threat_score": 6.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-10T12:17:28.944000+00:00",
        "last_seen_30d": "2026-05-10T12:27:56.256000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Adbhoney": 2
      }
    },
    "103.176.16.99": {
      "alert_count": 4,
      "first_seen": "2026-05-13T11:40:02.207Z",
      "last_seen": "2026-05-13T11:50:03.042Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        5555
      ],
      "protocols": [
        "TCP"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Delhi",
      "asn": 135687,
      "as_org": "Qwistel Network Service Private Limited",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T11:39:46.703000+00:00",
        "last_seen_30d": "2026-05-13T11:50:03.042000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Adbhoney": 2
      }
    },
    "104.49.178.39": {
      "alert_count": 4,
      "first_seen": "2026-05-21T17:48:22.315Z",
      "last_seen": "2026-05-21T17:48:22.316Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        7574
      ],
      "protocols": [
        "TCP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Deltona",
      "asn": 7018,
      "as_org": "AT&T Enterprises, LLC",
      "threat_score": 13.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-21T17:47:10+00:00",
        "last_seen_30d": "2026-05-21T17:48:22.316000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Honeytrap": 1
      }
    },
    "111.92.152.187": {
      "alert_count": 4,
      "first_seen": "2026-05-04T22:15:02.139Z",
      "last_seen": "2026-05-04T22:16:07.944Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        80
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 131275,
      "as_org": "Logon Broadband Pvt. Limited",
      "threat_score": 1.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-04T22:15:02.139000+00:00",
        "last_seen_30d": "2026-05-04T22:16:07.944000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4
      }
    },
    "117.134.197.75": {
      "alert_count": 4,
      "first_seen": "2026-05-07T11:40:07.820Z",
      "last_seen": "2026-05-07T11:41:24.669Z",
      "signatures": [
        "ET SCAN JAWS Webserver Unauthenticated Shell Command Execution",
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Web Application Attack"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        60001
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Islamabad",
      "asn": 138423,
      "as_org": "CMPak Limited",
      "threat_score": 4.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T11:40:06+00:00",
        "last_seen_30d": "2026-05-07T11:41:24.669000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Honeytrap": 1
      }
    },
    "117.134.197.79": {
      "alert_count": 4,
      "first_seen": "2026-05-07T19:14:26.828Z",
      "last_seen": "2026-05-07T19:24:29.939Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        5555
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Islamabad",
      "asn": 138423,
      "as_org": "CMPak Limited",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-07T19:14:15.767000+00:00",
        "last_seen_30d": "2026-05-07T19:24:29.939000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Adbhoney": 2
      }
    },
    "120.85.113.209": {
      "alert_count": 4,
      "first_seen": "2026-05-20T04:20:33.911Z",
      "last_seen": "2026-05-20T04:21:37.059Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        80
      ],
      "protocols": [
        "TCP"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 17622,
      "as_org": "China Unicom Guangzhou network",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-20T04:20:33.911000+00:00",
        "last_seen_30d": "2026-05-20T04:21:37.059000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4
      }
    },
    "120.85.119.91": {
      "alert_count": 4,
      "first_seen": "2026-05-20T01:30:41.757Z",
      "last_seen": "2026-05-20T01:31:46.043Z",
      "signatures": [
        "ET SCAN JAWS Webserver Unauthenticated Shell Command Execution",
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Web Application Attack"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        80
      ],
      "protocols": [
        "TCP"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 17622,
      "as_org": "China Unicom Guangzhou network",
      "threat_score": 12.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-20T01:30:41.511000+00:00",
        "last_seen_30d": "2026-05-20T01:31:46.043000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Tanner": 1
      }
    },
    "121.35.170.15": {
      "alert_count": 4,
      "first_seen": "2026-05-18T06:11:38.882Z",
      "last_seen": "2026-05-18T06:21:47.252Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        5555
      ],
      "protocols": [
        "TCP"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shenzhen",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T06:11:20.655000+00:00",
        "last_seen_30d": "2026-05-18T06:21:47.252000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Adbhoney": 2
      }
    },
    "14.1.104.175": {
      "alert_count": 4,
      "first_seen": "2026-05-15T10:36:59.563Z",
      "last_seen": "2026-05-15T10:47:04.628Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        5555
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 9.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-15T10:36:48.955000+00:00",
        "last_seen_30d": "2026-05-15T10:47:04.628000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Adbhoney": 2
      }
    },
    "182.190.220.156": {
      "alert_count": 4,
      "first_seen": "2026-05-06T03:57:08.316Z",
      "last_seen": "2026-05-06T03:57:08.320Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        7574
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Hyderabad",
      "asn": 136525,
      "as_org": "Wancom Pvt Ltd.",
      "threat_score": 3.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-06T03:55:58+00:00",
        "last_seen_30d": "2026-05-06T03:57:08.320000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Honeytrap": 1
      }
    },
    "2.181.57.140": {
      "alert_count": 4,
      "first_seen": "2026-05-31T12:23:29.666Z",
      "last_seen": "2026-05-31T12:24:48.012Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        7574
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 58224,
      "as_org": "Iran Telecommunication Company PJS",
      "threat_score": 19.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-31T12:23:27+00:00",
        "last_seen_30d": "2026-05-31T12:24:48.012000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Honeytrap": 1
      }
    },
    "206.135.161.69": {
      "alert_count": 4,
      "first_seen": "2026-05-29T16:10:31.382Z",
      "last_seen": "2026-05-29T16:11:36.374Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        80
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-29T16:10:31.382000+00:00",
        "last_seen_30d": "2026-05-29T16:11:36.374000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4
      }
    },
    "38.100.223.134": {
      "alert_count": 4,
      "first_seen": "2026-05-13T22:20:29.887Z",
      "last_seen": "2026-05-13T22:21:42.454Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        7574
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 152605,
      "as_org": "Z COM NETWORKS",
      "threat_score": 7.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-13T22:20:28+00:00",
        "last_seen_30d": "2026-05-13T22:21:42.454000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Honeytrap": 1
      }
    },
    "45.234.3.51": {
      "alert_count": 4,
      "first_seen": "2026-05-28T18:13:04.590Z",
      "last_seen": "2026-05-28T18:14:08.768Z",
      "signatures": [
        "ET SCAN JAWS Webserver Unauthenticated Shell Command Execution"
      ],
      "categories": [
        "Web Application Attack"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        80
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Cascavel",
      "asn": 267335,
      "as_org": "MUNDIAL TELECOMUNICACAO LTDA - ME",
      "threat_score": 12.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-28T18:13:04.590000+00:00",
        "last_seen_30d": "2026-05-28T18:14:08.768000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4
      }
    },
    "58.23.87.246": {
      "alert_count": 4,
      "first_seen": "2026-05-08T19:50:59.960Z",
      "last_seen": "2026-05-08T20:01:07.875Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        5555
      ],
      "protocols": [
        "TCP"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Xiamen",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 4.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-08T19:50:44.659000+00:00",
        "last_seen_30d": "2026-05-08T20:01:07.875000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Adbhoney": 2
      }
    },
    "61.70.80.228": {
      "alert_count": 4,
      "first_seen": "2026-05-25T17:22:00.111Z",
      "last_seen": "2026-05-25T17:32:06.044Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        5555
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Kaohsiung",
      "asn": 9416,
      "as_org": "Hoshin Multimedia Center Inc.",
      "threat_score": 16.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-25T17:21:49.464000+00:00",
        "last_seen_30d": "2026-05-25T17:32:06.044000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Adbhoney": 2
      }
    },
    "66.167.166.55": {
      "alert_count": 4,
      "first_seen": "2026-05-05T23:55:27.253Z",
      "last_seen": "2026-05-06T00:05:30.625Z",
      "signatures": [
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        5555
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-05T23:55:13.138000+00:00",
        "last_seen_30d": "2026-05-06T00:05:30.625000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Adbhoney": 2
      }
    },
    "67.102.7.15": {
      "alert_count": 4,
      "first_seen": "2026-05-18T02:20:13.547Z",
      "last_seen": "2026-05-18T02:21:24.468Z",
      "signatures": [
        "ET SCAN JAWS Webserver Unauthenticated Shell Command Execution",
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Web Application Attack"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        80
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 11.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-18T02:20:13.159000+00:00",
        "last_seen_30d": "2026-05-18T02:21:24.468000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Tanner": 1
      }
    },
    "72.255.32.10": {
      "alert_count": 4,
      "first_seen": "2026-05-11T10:52:51.856Z",
      "last_seen": "2026-05-11T10:54:04.047Z",
      "signatures": [
        "ET SCAN JAWS Webserver Unauthenticated Shell Command Execution",
        "ET SCAN Mirai Variant User-Agent (Inbound)"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain",
        "Web Application Attack"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        60001
      ],
      "protocols": [
        "TCP"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 6.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-05-11T10:52:50+00:00",
        "last_seen_30d": "2026-05-11T10:54:04.047000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Honeytrap": 1
      }
    },
    "77.90.25.253": {
      "alert_count": 3,
      "first_seen": "2026-05-09T17:40:51.154Z",
      "last_seen": "2026-05-13T16:12:19.256Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11910 anomalous ICMPv4 type 3,code 4 Path MTU Discovery"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [],
      "protocols": [
        "ICMP"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 215828,
      "as_org": "TMW Global Networks",
      "threat_score": 5.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 4.2,
        "diversity": 0,
        "spread": 5,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 5,
        "ports_targeted_30d": 0,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-09T17:40:51.154000+00:00",
        "last_seen_30d": "2026-05-13T16:12:19.256000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3
      }
    },
    "89.187.182.6": {
      "alert_count": 3,
      "first_seen": "2026-05-08T20:32:00.732Z",
      "last_seen": "2026-05-08T20:33:07.857Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11910 anomalous ICMPv4 type 3,code 4 Path MTU Discovery"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [
        443
      ],
      "protocols": [
        "TCP",
        "ICMP"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 60068,
      "as_org": "Datacamp Limited",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-08T20:32:00.732000+00:00",
        "last_seen_30d": "2026-05-08T20:33:07.857000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3
      }
    },
    "202.112.237.226": {
      "alert_count": 2,
      "first_seen": "2026-05-28T14:44:13.495Z",
      "last_seen": "2026-05-28T14:44:49.669Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [],
      "protocols": [
        "IP-in-IP"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4538,
      "as_org": "China Education and Research Network Center",
      "threat_score": 8.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 3.0,
        "persistence": 0.8,
        "diversity": 0,
        "spread": 5,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 2,
        "days_active_30d": 1,
        "ports_targeted_30d": 0,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-28T14:44:13.495000+00:00",
        "last_seen_30d": "2026-05-28T14:44:49.669000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 2
      }
    },
    "172.105.186.116": {
      "alert_count": 1,
      "first_seen": "2026-05-06T04:09:22.775Z",
      "last_seen": "2026-05-06T04:09:22.775Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11910 anomalous ICMPv4 type 3,code 4 Path MTU Discovery"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [],
      "protocols": [
        "ICMP"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 1.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 0.0,
        "persistence": 0.8,
        "diversity": 0,
        "spread": 5,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 1,
        "days_active_30d": 1,
        "ports_targeted_30d": 0,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-06T04:09:22.775000+00:00",
        "last_seen_30d": "2026-05-06T04:09:22.775000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1
      }
    },
    "202.112.237.200": {
      "alert_count": 1,
      "first_seen": "2026-05-06T02:58:34.352Z",
      "last_seen": "2026-05-06T02:58:34.352Z",
      "signatures": [
        "ET EXPLOIT Possible CVE-2020-11910 anomalous ICMPv4 type 3,code 4 Path MTU Discovery"
      ],
      "categories": [
        "Attempted Administrator Privilege Gain"
      ],
      "severities": [
        1
      ],
      "dest_ports": [],
      "protocols": [
        "ICMP"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4538,
      "as_org": "China Education and Research Network Center",
      "threat_score": 1.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 0.0,
        "persistence": 0.8,
        "diversity": 0,
        "spread": 5,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 1,
        "days_active_30d": 1,
        "ports_targeted_30d": 0,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-05-06T02:58:34.352000+00:00",
        "last_seen_30d": "2026-05-06T02:58:34.352000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1
      }
    }
  },
  "x_nadsec_summary": {
    "top_countries": {
      "United States": 277593,
      "Azerbaijan": 18054,
      "Pakistan": 226,
      "China": 118,
      "France": 13,
      "Argentina": 12,
      "India": 8,
      "Congo Republic": 5,
      "Gabon": 5,
      "Peru": 5,
      "Iran": 4,
      "Brazil": 4,
      "Taiwan": 4,
      "Germany": 3,
      "Australia": 1
    },
    "top_asns": {
      "Unmanaged Ltd": 274345,
      "MEVSPACE sp. z o.o.": 18054,
      "The Constant Company, LLC": 1867,
      "1337 Services GmbH": 833,
      "Hurricane Electric LLC": 531,
      "China Education and Research Network Center": 91,
      "TELECOMMUNICATION AND TECHNOLOGY MASTERS PVT. LIMITED": 88,
      "Pakistan Telecommunication Company Limited": 56,
      "Cyber Internet Services Pvt Ltd.": 47,
      "CMPak Limited": 18,
      "Contabo GmbH": 13,
      "China Unicom Guangzhou network": 13,
      "CHINA UNICOM China169 Backbone": 10,
      "AT&T Enterprises, LLC": 9,
      "Qwistel Network Service Private Limited": 8,
      "MEGALINK S.R.L.": 7,
      "CongoTelecom": 5,
      "GVA-Canalbox": 5,
      "FIBERISH PVT LTD": 5,
      "Telecom Argentina S.A.": 5
    },
    "top_signatures": {
      "ET SCAN Mirai Variant User-Agent (Inbound)": 30,
      "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free": 26,
      "ET SCAN JAWS Webserver Unauthenticated Shell Command Execution": 10,
      "ET INFO SSH session in progress on Unusual Port": 6,
      "SURICATA HTTP Unexpected Request body": 4,
      "ET EXPLOIT Possible CVE-2020-11910 anomalous ICMPv4 type 3,code 4 Path MTU Discovery": 4,
      "ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound": 3,
      "ET INFO SSH session in progress on Expected Port": 2,
      "ET EXPLOIT Possible Authenticated Command Injection Inbound - Comtrend VR-3033 (CVE-2020-10173)": 2,
      "SURICATA HTTP missing Host header": 2,
      "GPL VOIP SIP INVITE message flooding": 1,
      "GPL ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited": 1,
      "SURICATA Applayer Detect protocol only one direction": 1,
      "SURICATA HTTP request missing protocol": 1,
      "SURICATA SSH invalid banner": 1,
      "ET REMOTE_ACCESS Tunneled RDP msts Handshake": 1,
      "SURICATA STREAM spurious retransmission": 1,
      "ET EXPLOIT F5 TMUI RCE vulnerability CVE-2020-5902 Attempt M1": 1,
      "SURICATA HTTP Request unrecognized authorization method": 1,
      "ET EXPLOIT Multiple DrayTek Products Pre-authentication Remote RCE Inbound (CVE-2020-8515) M2": 1,
      "ET INFO Cleartext WordPress Login": 1,
      "SURICATA Applayer Mismatch protocol both directions": 1,
      "SURICATA HTTP Host header invalid": 1,
      "SURICATA HTTP Host part of URI is invalid": 1,
      "SURICATA HTTP Request excessive header repetition": 1,
      "SURICATA ICMPv4 invalid checksum": 1,
      "SURICATA STREAM Packet with broken ack": 1
    },
    "top_categories": {
      "Attempted Administrator Privilege Gain": 66,
      "Web Application Attack": 10,
      "Misc activity": 9,
      "Generic Protocol Command Decode": 9,
      "Attempted Denial of Service": 1,
      "Potentially Bad Traffic": 1,
      "Potential Corporate Privacy Violation": 1
    },
    "severity_distribution": {
      "1": 71,
      "2": 2,
      "3": 16
    },
    "targeted_ports": {
      "80": 19,
      "5555": 12,
      "443": 11,
      "8080": 9,
      "500": 7,
      "23": 6,
      "1337": 6,
      "22": 5,
      "1080": 5,
      "4081": 5
    },
    "protocols": {
      "TCP": 69,
      "UDP": 27,
      "IP-in-IP": 26,
      "ICMP": 6
    }
  },
  "x_mitre_attack": {
    "techniques": {
      "T1068": {
        "name": "Exploitation for Privilege Escalation",
        "tactic": "Privilege Escalation",
        "ip_count": 66,
        "sample_signatures": []
      },
      "T1190": {
        "name": "Exploit Public-Facing Application",
        "tactic": "Initial Access",
        "ip_count": 46,
        "sample_signatures": [
          "ET EXPLOIT F5 TMUI RCE vulnerability CVE-2020-5902 Attempt M1",
          "ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound",
          "ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"
        ]
      },
      "T1595": {
        "name": "Active Scanning",
        "tactic": "Reconnaissance",
        "ip_count": 35,
        "sample_signatures": [
          "ET SCAN Mirai Variant User-Agent (Inbound)",
          "ET SCAN JAWS Webserver Unauthenticated Shell Command Execution"
        ]
      },
      "T1071": {
        "name": "Application Layer Protocol",
        "tactic": "Command and Control",
        "ip_count": 16,
        "sample_signatures": []
      },
      "T1592": {
        "name": "Gather Victim Host Information",
        "tactic": "Reconnaissance",
        "ip_count": 9,
        "sample_signatures": [
          "ET INFO SSH session in progress on Expected Port",
          "ET INFO Cleartext WordPress Login",
          "ET INFO SSH session in progress on Unusual Port"
        ]
      },
      "T1498": {
        "name": "Network Denial of Service",
        "tactic": "Impact",
        "ip_count": 1,
        "sample_signatures": []
      },
      "T1005": {
        "name": "Data from Local System",
        "tactic": "Collection",
        "ip_count": 1,
        "sample_signatures": []
      }
    },
    "tactic_summary": {
      "Privilege Escalation": 66,
      "Initial Access": 46,
      "Reconnaissance": 44,
      "Command and Control": 16,
      "Impact": 1,
      "Collection": 1
    },
    "technique_count": 7,
    "primary_tactics": [
      "Privilege Escalation",
      "Initial Access",
      "Reconnaissance"
    ]
  },
  "x_nadsec_threat_summary": {
    "total_ips": 74,
    "scored_ips": 74,
    "threat_distribution": {
      "critical": 1,
      "high": 22,
      "medium": 9,
      "low": 4,
      "minimal": 38,
      "unknown": 0
    },
    "avg_threat_score": 34.3,
    "max_threat_score": 80.1,
    "top_threats": [
      {
        "ip": "65.49.1.145",
        "threat_score": 80.1,
        "threat_level": "critical",
        "total_events": 30,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "65.49.1.196",
        "threat_score": 79.6,
        "threat_level": "high",
        "total_events": 26,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "65.49.1.134",
        "threat_score": 78.3,
        "threat_level": "high",
        "total_events": 22,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "65.49.1.125",
        "threat_score": 77.8,
        "threat_level": "high",
        "total_events": 26,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "184.105.247.247",
        "threat_score": 77.1,
        "threat_level": "high",
        "total_events": 57,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "65.49.1.188",
        "threat_score": 74.9,
        "threat_level": "high",
        "total_events": 26,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "64.62.156.190",
        "threat_score": 70.3,
        "threat_level": "high",
        "total_events": 28,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "216.218.206.109",
        "threat_score": 69.7,
        "threat_level": "high",
        "total_events": 18,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "64.62.156.176",
        "threat_score": 68.9,
        "threat_level": "high",
        "total_events": 27,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "109.205.211.99",
        "threat_score": 68.1,
        "threat_level": "high",
        "total_events": 18054,
        "country": "Azerbaijan",
        "org": "MEVSPACE sp. z o.o."
      },
      {
        "ip": "64.62.197.127",
        "threat_score": 67.8,
        "threat_level": "high",
        "total_events": 20,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "65.49.1.148",
        "threat_score": 67.8,
        "threat_level": "high",
        "total_events": 20,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "64.62.197.178",
        "threat_score": 67.4,
        "threat_level": "high",
        "total_events": 19,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "216.218.206.101",
        "threat_score": 67.3,
        "threat_level": "high",
        "total_events": 14,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "45.148.9.200",
        "threat_score": 67.0,
        "threat_level": "high",
        "total_events": 274345,
        "country": "United States",
        "org": "Unmanaged Ltd"
      },
      {
        "ip": "64.62.156.228",
        "threat_score": 67.0,
        "threat_level": "high",
        "total_events": 22,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "65.49.20.121",
        "threat_score": 65.9,
        "threat_level": "high",
        "total_events": 16,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "216.218.206.92",
        "threat_score": 65.6,
        "threat_level": "high",
        "total_events": 17,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "184.105.247.223",
        "threat_score": 64.5,
        "threat_level": "high",
        "total_events": 16,
        "country": "United States",
        "org": "Hurricane Electric LLC"
      },
      {
        "ip": "124.198.131.22",
        "threat_score": 64.2,
        "threat_level": "high",
        "total_events": 404,
        "country": "United States",
        "org": "1337 Services GmbH"
      }
    ]
  }
}