Cisco ASA VPN trap on UDP 500/4500.

# Comprehensive Threat Intelligence Report: Cisco ASA Exploitation, Botnet Infrastructure, and Advanced Persistent Threats (2026-04)

**Key Points:**
*   **Massive Automated Enumeration:** The Cisco ASA honeypot in Sydney captured 23,820 total attacks from 1,666 unique IP addresses in April 2026, driven largely by automated scanning scripts and botnet infrastructure.
*   **Metasploit & Akira Ransomware Link:** A significant portion of the traffic exhibits the `fcadbadd=1` URL parameter, a definitive artifact of the Metasploit Cisco SSL VPN brute-force scanner [cite: 1, 2]. This technique is actively leveraged by Akira ransomware affiliates to identify VPNs lacking Multi-Factor Authentication (MFA) [cite: 3, 4].
*   **State-Sponsored Espionage (ArcaneDoor):** The telemetry aligns with the target profile of the ArcaneDoor campaign (UAT4356 / STORM-1849), a state-sponsored operation exploiting zero-day vulnerabilities (e.g., CVE-2024-20353, CVE-2024-20359) in Cisco Adaptive Security Appliances to deploy in-memory backdoors like Line Dancer and Line Runner [cite: 5, 6, 7].
*   **Advanced Botnet Ecosystems:** The attack data cross-references with infrastructure supporting advanced IoT and web-app botnets, notably the RondoDox "exploit-shotgun" framework [cite: 8, 9], the highly persistent "0cl/boatnet" Mirai variant [cite: 10], and the Deno-runtime-abusing DinDoor backdoor [cite: 11, 12]. 
*   **Bulletproof Hosting Abuse:** The vast majority of attacks originate from specific Autonomous System Numbers (ASNs) acting as bulletproof hosts, proxy networks, or compromised cloud providers, including tzulo inc., Omegatech LTD, and Datacamp Limited [cite: 13, 14, 15].

This report presents an exhaustive analysis of threat intelligence data gathered from the NadSec T-Pot honeypot infrastructure simulating a Cisco Adaptive Security Appliance (ASA) in Sydney, Australia, during the period of April 2026. Designed for an academic and technical cybersecurity audience, this research synthesizes honeypot telemetry with global threat intelligence to attribute attacks, decode infrastructure patterns, and map adversary methodologies. The data reveals a highly industrialized threat landscape where state-sponsored espionage actors operate in parallel with financially motivated cybercriminals and automated botnets, all vying for control over vulnerable perimeter networking devices. While the honeypot dataset lacks captured malware hashes due to the nature of the exploit attempts recorded (primarily HTTP GET/POST reconnaissance and initial access vectors), this report enriches the network indicators with behavioral intelligence derived from established cybersecurity research to construct a complete picture of the payloads and campaigns driving these attacks.

## 1. Executive Summary

In April 2026, the NadSec honeypot array specifically tuned to emulate Cisco ASA perimeter devices recorded intensive, coordinated exploitation attempts. Perimeter network devices have become the prime focal point for modern threat actors because they reside outside traditional Endpoint Detection and Response (EDR) coverage, handle highly sensitive encrypted traffic, and often suffer from patching delays. The dataset encompasses 1,666 unique IP indicators responsible for 23,820 discrete attack events.

The analytical breakdown of these indicators reveals a convergence of three distinct threat paradigms:
1.  **Ransomware Initial Access Brokers (IABs):** Utilizing open-source offensive security tools (OSTs) like Metasploit to brute-force Cisco SSL VPN portals. The goal is to obtain valid credentials for internal network pivoting, a tactic heavily associated with the Akira ransomware syndicate [cite: 3, 16].
2.  **State-Sponsored Cyber Espionage:** Aligning with the sophisticated "ArcaneDoor" campaign, actors are scanning for vulnerable Cisco ASAs to exploit zero-day and N-day vulnerabilities, aiming to deploy memory-resident implants for covert data collection and network traffic manipulation [cite: 7, 17, 18].
3.  **Next-Generation Botnet Operators:** Extensive scanning for generic Web application vulnerabilities, Docker API misconfigurations, and legacy router exploits points to the activity of botnets like RondoDox, DinDoor, and advanced Mirai variants ("0cl/boatnet") [cite: 8, 10, 11]. These botnets utilize "bulletproof" hosting providers to maintain resilient command and control (C2) infrastructures.

This report systematically unpacks these threats, beginning with a statistical overview of the dataset, moving through an exhaustive infrastructure and malware analysis, and concluding with actionable detection engineering signatures mapped to the MITRE ATT&CK framework.

## 2. Statistical Overview

The data synthesized in this report is derived from a full dataset of 1,666 original indicators collected throughout April 2026. The volumetric disparity between the number of unique IP addresses (1,666) and the total number of recorded attacks (23,820) indicates that the attackers are not merely scanning passively; they are engaging in aggressive, repetitive probing and brute-forcing against the targeted sensor.

### 2.1 Geographic Distribution of Attack Origins

While geographic IP attribution is inherently obfuscated by the use of proxies, compromised routers, and virtual private servers (VPS), examining the registration locations of the attacking IPs provides insight into the jurisdictional preferences of the threat actors.

| Rank | Country | Total Unique IP Addresses | Percentage of Total Dataset |
| :--- | :--- | :--- | :--- |
| 1 | United States | 21,209 (Event frequency from US space) | Dominant |
| 2 | Russia | 1,091 | Significant |
| 3 | Japan | 161 | Minor |
| 4 | Germany | 161 | Minor |
| 5 | Bulgaria | 150 | Minor |
| 6 | Hong Kong | 132 | Minor |
| 7 | Seychelles | 112 | Minor |
| 8 | France | 100 | Minor |

*Note: The high concentration of traffic from the United States is largely a byproduct of the massive data center footprint located within the US, utilized by proxy providers, VPN services, and cloud hosting platforms.*

### 2.2 Top Autonomous System Numbers (ASNs)

Analyzing the ASNs reveals the specific network providers facilitating the malicious traffic. Threat actors gravitate toward providers with lenient Acceptable Use Policies (AUPs), automated provisioning, and slow abuse-response times.

| ASN Name | Total Events | Classification / Threat Intelligence Context |
| :--- | :--- | :--- |
| tzulo, inc. (AS11878) | 7,121 | Data Center/Hosting. Frequently associated with high-volume scanning, VPN nodes, and brute-force campaigns [cite: 14, 19, 20]. |
| Omegatech LTD (AS202412) | 2,901 | Highly suspicious hosting. Linked to Virtualine Technologies, CrazyRDP, and the 0cl/boatnet Mirai C2 infrastructure [cite: 10, 13]. |
| Datacamp Limited (AS212238) | 2,054 | Operates CDN77 and NordVPN nodes. High volume of obfuscated DNS and port scanning traffic [cite: 15, 21, 22]. |
| Clouvider Limited (AS62240) | 1,690 | UK-based cloud provider. Frequently observed in generic web application scanning logs. |
| Host Telecom Ltd (AS214238) | 1,427 | Offshore hosting provider commonly flagged for accommodating botnet scanning [cite: 23, 24]. |
| Shock Hosting LLC | 1,346 | VPS provider observed hosting automated scanners. |
| M247 Europe SRL (AS9009) | 993 | Romanian ISP. Strongly linked to the Tycoon2FA Phishing-as-a-Service infrastructure and automated credential stuffing [cite: 25, 26]. |
| HostRoyale Technologies (AS203020) | 951 | Low-cost hosting provider known for harboring malicious scanners and vulnerability enumerators [cite: 27, 28, 29]. |

### 2.3 Key Exploitation Events and Payload Analysis

The honeypot logs capture the specific HTTP requests directed at the simulated Cisco ASA environment. The following table correlates the observed HTTP request strings with their associated attack methodologies.

| Observed HTTP Request | Hit Count | Threat Intelligence Mapping |
| :--- | :--- | :--- |
| `"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1" 200` | 1,134 | **Metasploit Scanner / Akira Ransomware:** The `fcadbadd=1` parameter is uniquely injected by the Metasploit `cisco_ssl_vpn.rb` auxiliary module to bypass caching and fingerprint the VPN portal [cite: 1, 2]. |
| `"GET /+CSCOE+/logon.html HTTP/1.1" 302` | 1,122 | **General VPN Enumeration:** Standard requests attempting to access the Clientless SSL VPN portal, likely to verify device presence before brute-forcing or exploiting CVE-2020-3259 [cite: 4, 30]. |
| `"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1"` | 885 | **Active Brute-Forcing:** Following enumeration, attackers post credentials to the WebVPN endpoint, utilizing the same Metasploit/OST frameworks [cite: 2, 31]. |
| `"GET / HTTP/1.1" 200` | 474 | **Reconnaissance:** Root directory probes by generic internet scanners (e.g., Censys, Shodan) and botnets attempting to identify the service banner. |
| `TimeoutError` | 404 | **DoS / Resource Exhaustion:** Volumetric attacks potentially related to CVE-2024-20353 (Web Services Denial of Service), heavily utilized in the ArcaneDoor campaign [cite: 32, 33]. |
| `"GET /lang/custom/sbin/init HTTP/1.1" 404` | 29 | **RondoDox Botnet / Wazuh Exploit:** A highly specific path traversal/RCE attempt targeting misconfigured dashboards, commonly scanned by the RondoDox multi-vector botnet [cite: 8, 34, 35]. |
| `"GET /+CSCOL+/csvrloader.jar HTTP/1.1" 404` | 23 | **Legacy Cisco Exploitation:** Attempts to download or interact with Java applets associated with older, vulnerable Cisco VPN clients. |

## 3. Infrastructure Deep Dive

Understanding the infrastructure utilized by these threat actors is critical for defensive attribution. Threat actors systematically abuse different tiers of the internet ecosystem, ranging from legitimate cloud providers to specialized "bulletproof" networks designed explicitly to ignore abuse complaints.

### 3.1 Bulletproof and High-Risk Hosting Ecosystems

**Omegatech LTD (AS202412)**
Omegatech LTD stands out as a highly specialized threat infrastructure provider within this dataset, generating nearly 3,000 attack events. Threat intelligence research indicates that Omegatech LTD is functionally intertwined with Virtualine Technologies, a known operator of malicious network spaces [cite: 13]. Specifically, IP blocks previously announced by Virtualine were migrated to Omegatech LTD in early 2026. Omegatech is intricately linked to the "CrazyRDP" service, an illicit marketplace providing cybercriminals with anonymous, pre-configured Remote Desktop Protocol (RDP) environments used as staging grounds for ransomware deployment and botnet management [cite: 13]. 
Furthermore, Omegatech infrastructure (e.g., `178.16.53.51`) has been directly identified as the primary C2 and payload delivery server for the advanced **"0cl/boatnet" Mirai variant** [cite: 10]. The network is also documented as hosting backend infrastructure for the **DinDoor** backdoor (a Deno-runtime malware related to the Tsundere botnet) [cite: 11, 12]. Organizations should treat ingress traffic from AS202412 with the highest level of suspicion.

**1337 Services GmbH (AS210558)**
Observed in the sample data (e.g., IP `185.241.208.50`, `45.138.16.42`), 1337 Services GmbH operates out of Poland and the United States and is a recognized haven for malicious botnet activity. Threat intelligence explicitly links this ASN to the **RondoDox botnet** campaign [cite: 8, 36, 37]. RondoDox operators utilize 1337 Services GmbH to host their payload delivery servers and C2 infrastructure [cite: 36]. The provider is known colloquially in underground forums as "StarkRDP" or `x1337.cc`, offering untraceable hosting services paid for via cryptocurrencies [cite: 36, 37]. The presence of this ASN in the logs strongly correlates with aggressive, "shotgun-style" vulnerability scanning.

**HostRoyale Technologies Pvt Ltd (AS203020)**
Based in India with server nodes globally (Boston, etc.), HostRoyale generated 951 events in the dataset. While it operates as a registered corporate entity, its incredibly low barrier to entry and slow response to abuse tickets make it a favorite for script kiddies and low-tier botnet operators [cite: 27, 28, 38]. The IPs from this ASN (e.g., `103.251.27.62`, `43.225.189.121`) are predominantly engaged in aggressive brute-forcing and Web Application Firewall (WAF) probing [cite: 27].

### 3.2 Cloud Abuse and Phishing-as-a-Service (PhaaS)

**M247 Europe SRL (AS9009)**
M247 Europe is a legitimate global ISP headquartered in Romania/UK. However, its infrastructure has been heavily co-opted by sophisticated cybercriminal organizations. In the honeypot dataset, M247 Europe generated 993 events (e.g., IP `146.70.187.115`). Crucially, threat intelligence from March 2026 identified M247 Europe as the primary network hosting the **Tycoon2FA Phishing-as-a-Service (PhaaS) platform** [cite: 26]. Even after a major Europol disruption operation against Tycoon2FA in early March 2026, the threat actors rapidly reconstituted their automated login and credential-stuffing infrastructure using new IPv6 and IPv4 blocks allocated by M247 Europe [cite: 26]. The activity observed in this Cisco ASA dataset likely represents automated credential testing using credentials harvested via the Tycoon2FA adversary-in-the-middle (AiTM) phishing framework.

**Datacamp Limited (AS212238) / tzulo, inc. (AS11878)**
Both Datacamp and tzulo represent massive sources of noisy, automated scanning. Datacamp operates the CDN77 content delivery network and hosts thousands of VPN exit nodes (such as those used by NordVPN) [cite: 15, 21]. The scanning activity from these ASNs is indicative of threat actors routing their Metasploit and brute-force traffic through commercial VPNs to mask their true geographic origin. The overwhelming volume from tzulo (7,121 events) highlights the scale of automated exploitation tools running constantly across compromised or anonymized VPS instances [cite: 14, 19].

## 4. Campaign Attribution & Threat Actor Profiling

The indicators of compromise (IOCs) and behavioral patterns extracted from the honeypot reveal several distinct, concurrent campaigns targeting the Cisco ASA environment.

### 4.1 The Akira Ransomware Nexus and Automated VPN Enumeration

**Methodology & Artifacts:**
The most prominent artifact in the dataset is the HTTP GET and POST requests appended with the `?fcadbadd=1` parameter (e.g., `"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1"`). 

This exact string is hardcoded into the Rapid7 Metasploit Framework module `cisco_ssl_vpn.rb`, authored to scan for Cisco SSL VPN web login portals and perform credential brute-forcing [cite: 2]. The script uses the `fcadbadd=1` query parameter as a cache-busting or session-handling mechanism to ensure fresh responses from the ASA device during mass enumeration [cite: 1, 2]. 

**Attribution:**
Since early 2023, and escalating significantly through 2024 and 2025, the **Akira ransomware syndicate** has systematically targeted Cisco ASA and Firepower Threat Defense (FTD) devices [cite: 3, 4, 30]. Akira affiliates rely heavily on identifying VPN portals that lack Multi-Factor Authentication (MFA). They utilize tools exactly like the Metasploit module observed in these logs to password-spray or brute-force active Directory accounts synced to the VPN [cite: 3, 16]. 

Furthermore, Akira operators are known to exploit **CVE-2020-3259**, an information disclosure vulnerability in the Cisco ASA web services interface, to extract usernames and passwords directly from the device's memory [cite: 4, 30]. The relentless probing of the `/+CSCOE+/logon.html` endpoint observed in the NadSec honeypot is the prerequisite reconnaissance phase for both credential stuffing and the exploitation of CVE-2020-3259 by ransomware Initial Access Brokers (IABs) [cite: 4, 16].

### 4.2 ArcaneDoor: State-Sponsored Espionage on the Perimeter

**Methodology & Artifacts:**
While ransomware operators seek quick financial gain, a much more insidious threat targets the same devices. **ArcaneDoor** is a highly sophisticated, state-sponsored cyber espionage campaign tracked by Cisco Talos as UAT4356 and by Microsoft as STORM-1849 [cite: 7, 32]. Active since at least July 2023, this group focuses on government, military, and critical infrastructure networks globally [cite: 5, 7].

The honeypot data shows numerous probes against the base web interface and subsequent `TimeoutError` events. These align with the reconnaissance and exploitation patterns of ArcaneDoor, which relies on a chain of zero-day vulnerabilities:
*   **CVE-2024-20353:** A Web Services Denial of Service (DoS) vulnerability. Attackers intentionally crash the ASA to force a reboot. The reboot sequence triggers the execution of their persistent implants [cite: 32, 33, 39].
*   **CVE-2024-20359:** A persistent local code execution vulnerability used to implant the malware into the read-only memory (ROM) of the device [cite: 17, 33].
*   **CVE-2025-20333 / CVE-2025-20362:** Newer zero-days observed in late 2025/early 2026 used to deploy advanced bootkits on ASA 5500-X series devices [cite: 7, 18, 40].

**Malware Analysis (ArcaneDoor):**
Once initial access is gained (often via zero-day exploit rather than brute-force), ArcaneDoor deploys a bespoke malware suite:
1.  **Line Dancer:** An in-memory shellcode interpreter. It hooks into the `processHostScanReply()` function of the Cisco ASA [cite: 5, 6]. Attackers send specially crafted POST requests containing shellcode within the `host-scan-reply` field (a field normally used during legitimate SSL VPN establishment). Line Dancer intercepts this, executing commands to disable syslog, steal configurations, and manipulate network traffic without requiring authentication [cite: 5, 6].
2.  **Line Runner:** A persistent backdoor that survives device reboots and firmware upgrades by manipulating the ASA's boot processes [cite: 6, 7].
3.  **RayInitiator & LINE VIPER:** Later evolutions of the campaign utilize the "RayInitiator" bootkit to compromise the GRUB bootloader, subsequently loading "LINE VIPER," a highly stealthy backdoor that grants complete root-level control over the firewall [cite: 18, 40].

### 4.3 RondoDox: The "Exploit Shotgun" Botnet

**Methodology & Artifacts:**
The honeypot logs feature highly specific, anomalous HTTP requests such as `"GET /lang/custom/sbin/init HTTP/1.1" 404` and queries directed at `vtigercrm`, `_asterisk`, and `framework/config.all.php`. These are not Cisco ASA vulnerabilities. Their presence on an ASA honeypot is the hallmark of the **RondoDox botnet** [cite: 8, 9, 41].

RondoDox, active since mid-2024, employs an "exploit-shotgun" approach. Rather than targeting a specific device, the botnet's scanners blindly fire a massive library of over 56 distinct exploits across more than 30 vendor architectures (routers, WebLogic, Next.js, TBK DVRs, IP cameras) at any exposed IP address [cite: 8, 42]. The request for `/lang/custom/sbin/init` specifically targets an old vulnerability in Wazuh dashboards [cite: 34, 43], demonstrating RondoDox's indiscriminate nature.

**Malware Analysis (RondoDox):**
*   **Payload Delivery:** RondoDox heavily utilizes infrastructure located at 1337 Services GmbH (AS210558) and Pfcloud UG for scanning and payload hosting [cite: 8, 36]. 
*   **Evasion & Obfuscation:** The primary RondoDox ELF binary (e.g., `rondo.x86_64`) encodes its internal configuration data, file paths, and C2 domains using a simple XOR algorithm with the hexadecimal key `0x21` [cite: 41]. 
*   **Network Behavior:** To evade network-level detection, RondoDox is programmed to disguise its malicious DDoS and C2 traffic as legitimate gaming platform or Virtual Private Network (VPN) traffic [cite: 8, 9, 41].

### 4.4 0cl / boatnet: Advanced Mirai Evolution

**Methodology & Artifacts:**
Threat intelligence correlates the heavy scanning from AS202412 (Omegatech LTD) directly to a highly sophisticated evolution of the Mirai botnet, self-identified by its creator as **"0cl"** and internally named **"boatnet"** [cite: 10]. 

**Malware Analysis (0cl/boatnet):**
Unlike standard, "script-kiddie" Mirai variants that are easily removed via reboot, 0cl/boatnet features exceptional engineering:
*   **Six-Layer Persistence:** The malware ensures survival across various Linux/IoT architectures by installing persistence mechanisms across six different OS init systems simultaneously: `cron` (`/etc/cron.d/`), `crontab` (`@reboot`), `rc.local`, Android `init.sh`, and a full `systemd` service unit (`19ju3d.service`) [cite: 10].
*   **Hash-Based Competitor Killing:** Traditional Mirai kills competing botnets by scanning for known process names or bound network ports. 0cl/boatnet reads the actual executable of every running process, computes its SHA256 hash, and compares it against a hardcoded list of 11 competitor malware hashes. If a match is found, it terminates the process, ensuring it monopolizes the host's resources regardless of how the competitor attempts to rename its executable [cite: 10].
*   **Delivery:** It utilizes dual delivery vectors: standard IoT vulnerability exploitation (via the same "shotgun" infrastructure as RondoDox) and misconfigured Docker API endpoints (POST to `/containers/create` fetching the `boatnet.x86` payloads) [cite: 10].

### 4.5 DinDoor & The Tsundere Botnet

**Methodology & Artifacts:**
Also hosted on Omegatech LTD and BL Networks (seen in the dataset) is the **DinDoor** backdoor [cite: 11, 12]. DinDoor is a severe evolution of the Tsundere botnet, notable for its abuse of legitimate development runtimes.

**Malware Analysis (DinDoor):**
*   **Deno Runtime Abuse:** DinDoor eschews traditional compiled binaries (like C or Go) or standard script interpreters (like Python or Node.js). Instead, it downloads the legitimate, signed **Deno JavaScript runtime** directly from the official repository (`dl.deno.land`) [cite: 11, 12]. It then executes heavily obfuscated malicious JavaScript within this trusted environment. This allows it to completely bypass EDR solutions that allowlist Deno but monitor PowerShell or Node.js [cite: 11, 12].
*   **Execution & Fingerprinting:** Distributed primarily via malicious MSI installers, the malware binds a TCP listener on localhost (ports 10044 or 10091) to act as a mutex [cite: 11]. It fingerprints the victim by hashing the username, hostname, and OS release into a 16-character hex string used for C2 check-ins [cite: 11, 12].
*   **Attribution:** Research indicates the DinDoor platform is utilized by the Iranian Advanced Persistent Threat (APT) group **Seedworm** (MuddyWater), though the underlying "Tsundere" platform operates as a multi-tenant Malware-as-a-Service [cite: 11, 12, 44].

## 5. Infrastructure Mapping and Attack Chain

The following maps the generalized attack chain observed across the differing threat vectors targeting the perimeter honeypot.

**Phase 1: Broad Reconnaissance (The Scanner Networks)**
*   **Actors:** Censys, Shodan, automated RondoDox bots, Datacamp VPN proxies.
*   **Action:** TCP SYN scans, simple HTTP GET requests (`/`).
*   **Objective:** Identify the service banner. Determine if the target is a Cisco ASA, a Linux server, or a generic IoT device.

**Phase 2: Targeted Enumeration & Vulnerability Probing**
*   **Vector A (Ransomware/IABs):** Utilizing `cisco_ssl_vpn.rb` (`fcadbadd=1`). Attempting to identify valid AD/LDAP usernames and test for the absence of MFA on the Clientless SSL VPN portal.
*   **Vector B (Botnets):** RondoDox and 0cl/boatnet blast the target with path traversal and command injection payloads (`/lang/custom/sbin/init`, `vtigercrm`, `DateSetting.cgi`) hoping the underlying OS is vulnerable [cite: 8, 45].

**Phase 3: Exploitation and Initial Access**
*   **Ransomware:** Successful credential stuffing leads to VPN tunnel establishment.
*   **ArcaneDoor (APT):** Exploitation of CVE-2024-20353 or CVE-2024-20359. The attacker sends a crafted POST request manipulating the `host-scan-reply` field to execute Line Dancer shellcode in memory, bypassing the AAA (Authentication, Authorization, and Accounting) module entirely [cite: 5, 6].
*   **Botnets (if target was a vulnerable Linux/IoT host):** Command injection forces the device to utilize `wget` or `curl` to reach out to C2 servers (e.g., Omegatech IP `178.16.53.51`) to download the `boatnet.arm7` or `rondo.x86_64` payloads [cite: 10, 41, 45].

**Phase 4: Persistence and Command & Control**
*   **ArcaneDoor:** Deploys RayInitiator into the GRUB bootloader, loading LINE VIPER to maintain root access across reboots [cite: 18, 40]. C2 communication is handled covertly by intercepting inbound HTTP POST requests.
*   **0cl/boatnet:** Writes persistence to `cron`, `systemd`, and `/etc/rc.local`. Begins computing SHA256 hashes of running processes to terminate competing malware [cite: 10].
*   **DinDoor:** Downloads `deno.exe`, executes obfuscated JavaScript, and beacons to shared C2 domains (e.g., `serialmenot[.]com`) using JSON Web Tokens (JWT) [cite: 12].

## 6. MITRE ATT&CK Mapping

The behaviors extracted from the threat intelligence surrounding these campaigns map comprehensively to the MITRE ATT&CK framework.

| Tactic | Technique ID | Technique Name | Campaign/Actor Context |
| :--- | :--- | :--- | :--- |
| **Reconnaissance** | T1595.002 | Active Scanning: Vulnerability Scanning | Automated botnets (RondoDox) and Metasploit scanners probing `/+CSCOE+/` and `/lang/custom/` endpoints. |
| **Initial Access** | T1190 | Exploit Public-Facing Application | ArcaneDoor exploiting CVE-2024-20359 / CVE-2024-20353 on Cisco ASAs [cite: 5, 6]. RondoDox exploiting React2Shell (CVE-2025-55182) [cite: 9]. |
| **Initial Access** | T1078 | Valid Accounts | Akira ransomware actors utilizing brute-forced VPN credentials without MFA [cite: 3, 16]. |
| **Execution** | T1059.004 | Command and Scripting Interpreter: Unix Shell | Botnets using injected shell commands (`wget`, `curl`, `chmod 777`) to download and execute payloads (`boatnet.x86`, `rondo.x86_64`) [cite: 10, 41, 45]. |
| **Execution** | T1059.007 | Command and Scripting Interpreter: JavaScript/JScript | DinDoor backdoor executing obfuscated JavaScript payloads using the trusted Deno runtime [cite: 11, 12]. |
| **Persistence** | T1542.001 | Boot or Logon Initialization Scripts: Systemd Service | 0cl/boatnet creating `19ju3d.service` to ensure execution upon reboot [cite: 10]. |
| **Persistence** | T1542.003 | Boot or Logon Autostart Execution: Bootkit | ArcaneDoor deploying the RayInitiator bootkit via GRUB to load LINE VIPER [cite: 18, 40]. |
| **Defense Evasion** | T1562.001 | Impair Defenses: Disable or Modify Tools | ArcaneDoor disabling syslog functions on the Cisco ASA to blind defenders [cite: 5, 6]. |
| **Defense Evasion** | T1127.001 | Trusted Developer Utilities Proxy Execution | DinDoor downloading and operating exclusively within the signed `deno.exe` runtime to bypass EDR [cite: 11, 12]. |
| **Defense Evasion** | T1480.001 | Execution Guardrails: Environmental Keying | 0cl/boatnet terminating rival botnets by continuously scanning and matching process SHA256 hashes against a hardcoded list [cite: 10]. |
| **Command & Control** | T1071.001 | Application Layer Protocol: Web Protocols | ArcaneDoor (Line Dancer) intercepting specially crafted HTTP POST requests to the `host-scan-reply` field for covert C2 [cite: 5, 6]. |
| **Impact** | T1498 | Network Denial of Service | RondoDox and 0cl/boatnet utilizing compromised edge devices to launch volumetric UDP/TCP DDoS attacks [cite: 8, 45]. |

## 7. Detection & Mitigation Engineering

Defending against the confluence of ransomware credential-stuffing, APT zero-day exploitation, and automated botnet scanning requires a defense-in-depth approach tailored to the perimeter edge.

### 7.1 Firewall and Network Hardening

1.  **Enforce Multi-Factor Authentication (MFA):** The absolute most critical mitigation against the Akira ransomware threat is the strict, exceptionless enforcement of MFA for *all* Clientless SSL VPN and AnyConnect portals [cite: 3, 16].
2.  **Disable Unused Services:** If Clientless SSL VPN is not actively required for business operations, disable it globally. Similarly, disable remote management interfaces (SSH/HTTPS) on the WAN port [cite: 46].
3.  **Patch Management:** Apply the latest firmware updates provided by Cisco addressing CVE-2024-20353, CVE-2024-20359, CVE-2025-20333, and CVE-2025-20362 immediately [cite: 6, 32, 40]. Note the guidance changes regarding specific firmware trains (e.g., upgrading to 7.2.5.2 or 7.2.7 due to bugs in 7.2.6) [cite: 39].
4.  **Geo-Blocking and ASN Filtering:** Implement edge blocking for high-risk ASNs with no legitimate business requirement, specifically AS202412 (Omegatech LTD) and AS210558 (1337 Services GmbH).

### 7.2 SIEM and Log Monitoring Queries

Organizations must monitor Cisco ASA syslog for indicators of compromise related to the ArcaneDoor campaign and brute-force attempts.

**Detecting Metasploit/Akira Enumeration:**
```sql
index=firewall vendor=cisco product=asa 
| search url="*/+CSCOE+/logon.html*" AND url="*fcadbadd=1*"
| stats count by src_ip
| where count > 10
```

**Detecting ArcaneDoor Anomalies:**
Monitor for undocumented configuration changes or sudden, unexplained device reboots (a hallmark of the CVE-2024-20353 DoS exploit used to load Line Runner) [cite: 5, 6].
```sql
index=firewall vendor=cisco product=asa 
| search (message_id=111008 OR message_id=111001) "reboot" OR "reload"
```

**Detecting DinDoor Deno Execution (Endpoint):**
Monitor EDR telemetry for the unexpected downloading and execution of the Deno runtime, especially spawned by `msiexec.exe` or `cmd.exe` [cite: 11, 12].
```sql
index=edr process_name=cmd.exe parent_process_name=msiexec.exe
| search command_line="*deno*" OR command_line="*dl.deno.land*"
```

### 7.3 Intrusion Detection Signatures (Snort/Suricata)

Deploy the following signatures to detect the malicious scanning parameters and payloads in transit.

**Detecting Metasploit Cisco SSL VPN Scanner:**
```suricata
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET SCAN Metasploit Cisco SSL VPN Brute Force Parameter (fcadbadd=1)"; flow:established,to_server; content:"GET"; http_method; content:"/+CSCOE+/logon.html"; http_uri; content:"fcadbadd=1"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)
```

**Detecting RondoDox / Wazuh Dashboard Scan:**
```suricata
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET EXPLOIT RondoDox Botnet Path Traversal Probe (/lang/custom/sbin/init)"; flow:established,to_server; content:"GET"; http_method; content:"/lang/custom/sbin/init"; http_uri; classtype:web-application-attack; sid:1000002; rev:1;)
```

**Detecting 0cl/boatnet Payload Download:**
```suricata
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE 0cl/boatnet Mirai Variant Payload Download Request"; flow:established,to_server; content:"GET"; http_method; content:"boatnet."; http_uri; fast_pattern; classtype:trojan-activity; sid:1000003; rev:1;)
```

## 8. IOC Appendix

*(Note: As the provided sample dataset originates from honeypot network edge logs capturing initial request telemetry, file hashes were not dropped directly to the sensor disk. The IPs below represent the highly active operational nodes conducting the scanning, brute-forcing, and vulnerability enumeration detailed in this report).*

### 8.1 High-Priority Attacker Infrastructure (IPs)

*   **23.234.x.x Subnets (tzulo, inc. / AS11878):**
    *   `23.234.82.105`, `23.234.92.106`, `23.234.106.231`, `23.234.81.233`
    *   **Context:** Massive automated scanning nodes utilizing the `fcadbadd=1` Metasploit artifact. Suspected proxies for Ransomware IABs (Akira).
*   **103.102.x.x / 103.81.x.x Subnets (HostRoyale Technologies / AS203020):**
    *   `103.102.247.62`, `103.102.246.175`, `103.81.230.62`
    *   **Context:** Low-tier bulletproof hosting utilized for continuous, high-volume brute-forcing of the Cisco `/+CSCOE+/logon.html` portal.
*   **146.70.x.x Subnets (M247 Europe SRL / AS9009):**
    *   `146.70.187.115`, `146.70.171.112`, `146.70.165.154`
    *   **Context:** Nodes linked to the Tycoon2FA Phishing-as-a-Service infrastructure, likely testing harvested session tokens and credentials against corporate VPN gateways [cite: 26].
*   **84.17.x.x / 138.199.x.x Subnets (Datacamp Limited / AS212238):**
    *   `138.199.43.71`, `138.199.43.75`, `149.40.50.115`
    *   **Context:** Obfuscated scanning traffic exiting via commercial VPN/CDN proxy layers.
*   **64.62.x.x Subnets (Hurricane Electric LLC / AS6939):**
    *   `64.62.156.159`, `64.62.197.109`, `64.62.197.233`
    *   **Context:** Botnet scanners actively probing for generic WebApp vulnerabilities, specifically the `/lang/custom/sbin/init` path associated with RondoDox methodologies [cite: 35, 47].
*   **130.12.180.32 (Omegatech LTD / AS202412):**
    *   **Context:** Noted scanning for SonicWall / SSLVPN endpoints. Associated with the broader Virtualine / CrazyRDP and 0cl/boatnet hosting ecosystem [cite: 10, 13].
*   **185.241.208.50 (1337 Services GmbH / AS210558):**
    *   **Context:** Deep Web bulletproof hosting. Scanning for obscure Asterisk/PHP vulnerabilities (`/_asterisk/vivovivo.php`), matching the RondoDox "shotgun" exploit profile [cite: 36, 37].

### 8.2 Associated Campaign Payloads (Threat Intel Derived)

While not extracted locally, defenders should hunt for the following file nomenclatures and artifacts associated with the infrastructure observed in these logs:
*   **ArcaneDoor:** `Line Dancer` (in-memory shellcode), `Line Runner` (persistent backdoor), `RayInitiator` (GRUB bootkit), `LINE VIPER` (root backdoor) [cite: 5, 6, 18, 40].
*   **RondoDox:** `rondo.x86_64`, `rondo.mips`, XOR encoding key `0x21` [cite: 41].
*   **0cl/boatnet:** `boatnet.arm7`, `boatnet.x86`, `19ju3d.service` (systemd persistence) [cite: 10, 45].
*   **DinDoor:** Execution of `deno.exe` fetching JavaScript from `serialmenot[.]com` via MSI installers like `installer_v1.21.66.msi` [cite: 12].

## Sources & Citations

1. [cite: 34] GitHub Issue 31958 - Wazuh "GET /lang/custom/sbin/init" Installation Assistant Logs.
2. [cite: 35] IPThreat Report for 64.62.156.116 - Unauthorized activity to HTTP: GET /lang/custom/sbin/init.
3. [cite: 47] IPThreat Report for 64.62.156.62 - Unauthorized activity to HTTP: GET /static/lang/custom/sbin/init.
4. [cite: 43] GitHub Issue 31324 - Wazuh Opensearch-Dashboards Logs 401 Unauthorized for /lang/custom/sbin/init.
5. [cite: 5] MITRE ATT&CK Campaign C0046 - ArcaneDoor.
6. [cite: 7] Cisco Talos - "ArcaneDoor: New espionage-focused campaign found targeting perimeter network devices" (April 2024).
7. [cite: 17] FortiGuard Threat Signal - "ArcaneDoor Attack (Cisco ASA Zero-Day)".
8. [cite: 48] Splunk Research - "ArcaneDoor" Threat Analytics and Detection.
9. [cite: 40] NHS Digital Cyber Alert CC-4703 - ArcaneDoor Campaign exploiting CVE-2025-20333, CVE-2025-20362.
10. [cite: 3] TekStream Security Bulletin - "Akira on Cisco Adaptive Security Appliance (ASA) VPN".
11. [cite: 49] SpotIT Security Bulletin - "Cisco ASA SSL VPN targeted by Akira Ransomware".
12. [cite: 30] Critical Start Report - "Akira Ransomware Exploits Cisco ASA/FTD Vulnerability (CVE-2020-3259)".
13. [cite: 4] Truesec CSIRT - "Akira and Cisco AnyConnect: The Working Exploit for CVE-2020-3259".
14. [cite: 16] Blumira - "Password Spraying Attacks Against Cisco ASA SSL VPNs".
15. [cite: 50] University of Florida IRB News - Notice regarding VPN login parameters (fcadbadd=1).
16. [cite: 51] BigBlueButton Google Groups - Debugging Nginx upstream requests with fcadbadd=1.
17. [cite: 52] HackerOne Report 943717 - Path Traversal (CVE-2020-3452) involving logon.html?fcadbadd=1.
18. [cite: 32] BitSight Threat Research - "ArcaneDoor Vulnerabilities CVE-2024-20353 & CVE-2024-20359".
19. [cite: 33] NHS Digital Cyber Alert CC-4483 - Cisco Releases Security Updates Addressing ArcaneDoor Campaign.
20. [cite: 6] HelpNetSecurity - "Hackers backdoored Cisco ASA devices via two zero-days (CVE-2024-20353, CVE-2024-20359)".
21. [cite: 39] Cisco Security Center - "Cisco Event Response: Attacks Against Cisco Firewall Platforms".
22. [cite: 53] HackerOne Report 1026265 - Unauthenticated Arbitrary File Deletion involving logon.html?fcadbadd=1.
23. [cite: 31] AbuseIPDB Report - CiscoASA Honeypot hit, Payload: "POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1".
24. [cite: 1, 2] Metasploit Framework - `cisco_ssl_vpn.rb` auxiliary scanner module utilizing `fcadbadd=1`.
25. [cite: 46, 54] Sequretek / Cymmetria - Research on Cisco Web UI login page exploitation attempts (`fcadbadd=1`).
26. [cite: 55] Scamalytics ISP Report - 1337 Services GmbH Fraud Risk.
27. [cite: 36] BitSight Blog - "RondoDox Botnet Infrastructure Analysis".
28. [cite: 37] AbuseIPDB Report 185.241.208.236 - 1337 Services GmbH Port Scan Attacks.
29. [cite: 13] Recorded Future Insikt Group - "2025 Malicious Infrastructure Insights by the Numbers" (Omegatech LTD / Virtualine).
30. [cite: 10] ELLIO Threat Intelligence - "0cl/boatnet: a Mirai variant that takes persistence seriously".
31. [cite: 12] Hunt.io Blog - "DinDoor Deno Runtime Backdoor MSI Analysis" (Omegatech LTD infrastructure).
32. [cite: 11] GBHackers - "Deno and MSI Installers Exploited" (Tsundere Botnet / DinDoor).
33. [cite: 19] AbuseIPDB Report 68.235.33.104 - tzulo, inc. Data Center/Web Hosting.
34. [cite: 14] AbuseIPDB Report 68.235.48.108 - tzulo, inc. Scanning Abuse.
35. [cite: 20] AbuseIPDB Report 68.235.38.2 - tzulo, inc. Scanning Abuse.
36. [cite: 56] CleanTalk Blacklist - AS11878 tzulo, inc.
37. [cite: 25] AbuseIPDB Report 89.44.201.54 - M247 Europe SRL Vulnerability Scanner.
38. [cite: 26] CrowdStrike - "Tycoon2FA Phishing-as-a-Service Platform Persists Following Takedown" (M247 Europe SRL infrastructure).
39. [cite: 27] AbuseIPDB Report 43.225.189.121 - HostRoyale Technologies Web Attack/Malicious Scanning.
40. [cite: 38] HostRoyale Technologies - Acceptable Usage Policy.
41. [cite: 28] CleanTalk Blacklist - AS204287 HostRoyale Technologies Pvt Ltd.
42. [cite: 29] AbuseIPDB Report 185.108.107.62 - HostRoyale Technologies Unauthorized Port Scanning.
43. [cite: 15] AbuseIPDB Report 84.17.38.147 - Datacamp Limited Port Scan Hacking.
44. [cite: 21] Reddit r/homelab - "Suspicious network activity - Datacamp Limited" (DNS scanning via CDN77).
45. [cite: 22] CleanTalk Blacklist - AS212238 Datacamp Limited.
46. [cite: 23] AbuseIPDB Report 195.133.60.146 - Host Telecom Ltd.
47. [cite: 24] AbuseIPDB Report 171.22.128.170 - Host Telecom Ltd.
48. [cite: 57] F5 Labs - "Mirai Is Attacking Again... Explicit C&C Hostnames" (boatnet variants).
49. [cite: 58] Akamai SIRT - "March Edimax Cameras Command Injection Mirai" (boatnet.arm7 payloads).
50. [cite: 45] CyberPress - "Mirai Botnet Exploiting Command Injection Vulnerabilities" (LZRD / boatnet.arm7).
51. [cite: 18] SecPod - "Technical Breakdown: How the ArcaneDoor Group Leverages Multiple Cisco Zero-Days".
52. [cite: 8] SecPod - "RondoDox Rampage: A Multivendor Exploit Shotgun Botnet".
53. [cite: 9] BankInfoSecurity - "RondoDox Botnet Exploiting Devices' React2Shell Flaw".
54. [cite: 41] Fortinet Threat Research - "RondoDox Unveiled: Breaking Down a Botnet Threat".
55. [cite: 42] Trend Micro Research - "RondoDox Botnet Campaign Exploiting Over 50 Vulnerabilities".
56. [cite: 59] CSK Gov Alerts - "RondoDox botnet targeting IoT devices and web applications".
57. [cite: 11] GBHackers - "DinDoor: Deno JavaScript runtime backdoor".
58. [cite: 44] Broadcom Security Center - "Dindoor backdoor malware Protection Bulletin".
59. [cite: 12] Hunt.io - "DinDoor Deno Runtime Backdoor MSI Analysis" (Caddy server exposure).

**Sources:**
1. [ustc.edu.cn](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFAcqQqWb9mKRQzAAONYc6v3Ywm5OuTTOn4rRXypED6a_Y9yDyvHrVWsYUQv6NLQtFjz09lVIQkfEyUwe9T2NAAWE1mlunQ8OqfcAVjf-mmm2J74iJV_yWSDidfielU410DHz64JJL_ezyK8tokIoCuuFXM2NjG-ijJuIg4K1NMpFAcn5vnsaZvUuoB0WAUvwtCeUDOo5YFJSpwfFHu40hnUDhEQAX4ciUH7UpaiyRlWFf-mmR-sNTD2Tgvk6dGC-sFRqC1vqwB4M53Qjc=)
2. [github.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEaKmCiGvO75FaJt4pQWQJY1J3YX97QMZ7Wg_1wF521Om-TfUkIfNyxYYqiwF3NFeP_IaecINGAU5jqI5hdvL2IWb942U_CretqsWkRfxLsQih68uDSDypKKkG93zFsi_mOh40xz8FhR4sUCfntqVgYCOO1B8Z8PxhX1Vs15UsWL7Q3yG6y7K4Zpjd9Bh3wPaDMxe4IeGkvnzX3o2P4IrE=)
3. [tekstream.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHKpD_AgMVPuC13sm58KW7Xjb-VSX2HXibA6LwTsuP1xRmGNKnSulrdxHcs04Mx-CYOpBa0OYwcSRwY6d_QInfoaAnuaRUUXhVw3Fq8GvOcxKuBGtktM8mor9Qt_YwUS7xSHopkJRZrf3Ln4tSDEQzbRj9PF9oz8SiZuqeK-V0GSGCSStP2EBjGe8BCyhqt66molj8otzDVEcdwwY44kGPTlcup)
4. [truesec.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFGGlrE_ml0MdpwZNExW3CSRNG-uyHTVsjtWZusHQ_UiOY4qFTQBDuYNKO38Dd5vwCOvNW0KyvA5CKN1gIY0-yMxelDzGUTH5GeWyj3X5hJ5EOCG06caEQv0YPhn28BYsoaqPZ7jAGZFRLowkGovo2rNpHpBFiGrZGGpPEEapKn1TnaMFvYcy3Hp0FR3NlXThoQUyCXUIs=)
5. [mitre.org](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGAFrs2ULAzSgm92wwlbdEw-eZKwNguRBZQ39lskZneE03UghfPqJbBb017yrDvopzJS39kOI078D60gwbZdyK6h8Nzu-rxYRdLUjRMmrZxpwvfwFV_U6DhBX_APWIg)
6. [helpnetsecurity.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGhnTOawympBXyrtYxQ1rg7EEhHLUA1BqVrNTFWJddd5zB1ELkEkTA4j9SAzgC7IAHpYIO_hEGWkUgmPjW5NTtlFCr_fpblOdd6lTpSByBSi57HXyYB0tCjt0fO4ZbtInBl_N8EayzqUY7_thJaku610LUr2GZtpU9joXuXfL0=)
7. [talosintelligence.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFjovr64KDsl_7Y8MtwxgBLoEFtxLG3mBgBq7IsAspz_9du5Uzj3UNndtFVk7EQjNH_W-WWO6sHUGhbUhUG02-H27O2E-AgqUU_8daguHeJ79LmItY8sxtLNW4fnfVgjAoI7WAwGWfyuoAjVcf7UVCGpoASnzmnaMeWyhioQkTu1dDT4SNTN2QrhLrm52UhDeqXLv66C2LWHDHUXg5LWQlyKL2QBL1Sp4OSD9rY)
8. [secpod.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQG0GoKhsLFfP7SJyfEGkqR4c1MpiFMjCBkHLBBXDE1hZ6DXZmTD9h582SagdeINMT35FlEyVX15nyc0150-4cTakSGhPYna5UcuMaoMt7dGIAgu4QnQJJyVS332f0RBQ9RcxKT__Bf_lRXFTnm6Qhexm6zypfTvrX0xkVbUTz3UM6D8unjQhT4=)
9. [bankinfosecurity.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFJWOpDD-rC4TDKvHDgTtgccm2afXS1kHHKuNac3V1KuuvlcqV8-QAWxrlP4udpe9R9c8OvQjmN13Fnmm_obq7aK4uoQ4sS5_iZ5xN83by4tG6YBIVJop_rHPXGO3KvTND90mDnE5JYJl8m6md_mpDrlftAkEcp-lvavPnKVc6o8h7kAdWHRYz5_Jmyy88t7r31)
10. [ellio.tech](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGQKQSzW6f6fjtNaXjlyJ3HmJY6sWumE2WxiG32H9iTXMk0vIf9GxOyNzdZqSg78JDRsfSFNyZw6KU3UAFIklCRjKRFevAVaOXQNYDfVXYJWEXJ7m5SoTyQ5zAQEwbA67-SwJUCQto2aVcafKM7Zz4GyFMGyouQKuEUQk55bJvtP49tbCO4hnUgrbPRI49U3Aw=)
11. [gbhackers.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFOGTonpsui_2k87A_jgwmK9ab9TzEZxOHWGuMXLO4l8r5zziE1stWATyndPKOw9ZAucsFbnj2WcnzWWQ05ucP3T-H7A8O06OmsZBV-ZpiIvjmbgYzCKPH0KVzhMjmbum3QbYn28d6hVilQRWS-)
12. [hunt.io](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFfY2capcbIdLG7o0eXTW5nq65iHa3TQ8LmCMz9g2X5PZpgneTOlH8RCsa7idViMlTfjc9Hemf2dFLq8w0kQ3e3GqtOncU-1G5KJAYsOWdHVT9c2CiXWiI1bOPUGvHE32wJhUkreugRbIQDqqI8nVTxPFCgsw==)
13. [recordedfuture.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGg8yNw7l_XKDxsFoFpcrXM3tkxi5dDbWdOlerGwRgqNUmvfDkIo4aYcTmgEi2oqBVTj6mbGfBs991ichgDbesZHCnlrm9qbwDp8OZYnAoIs9enAmyU1DTTEfIbP4jIe5ZhgR30_HYYVQ17MnG1TDn2WvsDSymaTNwf-XGtcQgjoQ==)
14. [abuseipdb.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFsNxhdnjJBorDnzap9_N-S1qxuOuN9Hd9N305Y_itltDbWXzMmOvP1ryq4Fh7HlwNF17vLz8PGjCXhffHBJuuyG3zbaeJKZsbGnBkkGunMc3kzypXojXyHro71GJkNuQcw3g==)
15. [abuseipdb.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHnUzlRxWqDbmQNv8K6D0voSeIWlgxyRA64uOuAAZgPnGFczK8EjgGJCbnHzChSB2pUm2l015TZ5BL_LSdnjcbfGTg_Dx9QvnO-8uqIgZnpstV4LIstqjuVfGtFlnBvgSVL)
16. [blumira.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQERGE7yckxl_yuS1IuBl25NGaEThCeR5W4grQtzUVmaK-va2N6ju1MMB_TFNhCL3w4Id349V6psI-yv5LovpLlOLE7KhFDaHVpTW4EL1OIR4a8u-l3DE9lDjpche8C2bqly5YDGmkGGV629mAOcIFXfxpqjv2I6JN7PfNkBahZs-iMY89JGqQ==)
17. [fortiguard.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQH9Y_SNWKj1HgQAroajiskGSZAqQzxCzPhXIOoKkmfN2FaJCCnJcVxLPSxEdO8sX9xVrbEx19qgi5V3YnJ17A-pirZIFovN8cEqDrrZVr1LqcJJr-kzAu2FnSxKY_Pb68RQri2xfyG5ZFi97aVqMASCak3TblgVLt2jPpf7CXrB7Tt0SZof0C1wvUwOIrxi)
18. [secpod.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEOE0giWxMGDnjm67aDcmGhVocjpbelukeWR1ZRaR8HV_AqeImHBdwYnglJn0188PR-CtMbM76GJn7vpwpMLlrfVSwPpXUdygQ4OFFTWRR_KX9Bh5VOMA2sbAdFw6UeQDh0tyPL7s0Sc1r-TGaaVEctPXZgNJghKtLx85jNycfv00J8To4e_wPstFibK7Sd40NPZAFu1rKh1neSlBI0pOSvtYPE7k1E5g7JQ-VvSv8477tZKhjpfFIEP2Oa4Q==)
19. [abuseipdb.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFieoiJXVV_iodfwv5tYhk1NvwjRLSq7DipuiqykZ9OlqzK2a8KclOOu0QuiE-jB1iXkGO4Vn1oTmbrJx5lI9H9ogBuXlE0IwGIC5x-3LZUowQM747k4d7l_g6X0WEuu2zqjw==)
20. [abuseipdb.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGVIbA5WIgVhG5nfWIvEPwwJSOQxpF2rDdhfeqqDGK5IvlSE-2718FO3W4fCN-4kgEMbZ7OhqEK1b-uNw5SHAUfPLIsIxLY9qkE61H1w7Wx9UFWxYLOu9NSvLu3sZiAEWc=)
21. [reddit.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFMkXwLb7oW_aIY2dWXMMMhq1ARvZpCU88hJha7cLuqJmcstCs88bigeaDJq1mrD1D7hQ9LdKLTqjefZKxoWgX8MrdjoMLaZr0clQVttQO0yESFQPuL31J2hCYJW5145X6TrysbqDvZbs5th9cUHg9WO7NsUdURxhXJyKZo-egiv7pFY6krq729c6BfikRDj-VTcSw=)
22. [cleantalk.org](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHRU8CufvyIomDWJRi3aNlAPBaKANwilWlqK2wlekuwiuJ9RW4DrzyuGO-WjdSXDEycpMsFuq4pCdpXBODx5mJ54dQzuYngmwnDuQ2Z7_Etw3CSJSjizU9ExlXg2-iZ)
23. [abuseipdb.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHP_038EM1AXWainGKuqcP1m3XkIqp8X51XNuMYqc4d7zPVQkvvaifM8dVL4LqBqrnV0w-gUC6dmRXUZTOL9g-BozNAVhRSPeQZ7kkNRsTIA7o_9ZM1ZUBfASOlrq9jukOZ9Rc=)
24. [abuseipdb.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHGDI7CnL4ob2N4CogEpxq2OeCOlMivziyW0KI8X4DH6btFVElzg25MUmtKNZD1gA5ScAz8fNAaHyGDD7qAoM_tzgBsMDBABe5pKuSSSo1na7QvOS68jkEcrvEO9OcbOF-J6F0=)
25. [abuseipdb.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGg17s_pYezAIVJLA5aO8ZLx_OiZXWszVk5BVX0iddxFXS577UPPeqcNL6EGDDFR3T6g9L6MNY6qPObABgOEuNgiSY7ATTT99kavPw0M0tSPGwCHea3_zt-627Ziph4e5r0)
26. [crowdstrike.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEP7x3atIbhM6oW57bOSwk32NLqtTOG2bQBItPZld6COVQc31MMrVCbSVe4B2O8m1MZ6M2Cv1PZvQZUZyi7QDvZeTtkxTCXrKWBSlYJX1zgDzUoQnkUbmR6EIeD48vf0SDbjjpoiTBUyX_qaKTdmc_K_BNI6WECGPmsUCmWrFJCmaPM6_l4Y-AGG6IKKxPnkpp4OVh8nOt7AuBtziWJu2v18Q==)
27. [abuseipdb.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQH52f2XGaLcrqNTbHS13YIXqQa-Gsjzlg-REbjzhp-kNVwkmEgUtIPcOdOmaFym7LMR5y509pU1SQJ0pU6ifNXWhl6dndfHZoWq8x78RI9E7Fq4fYfPf1KYCvJl8L7o_xFBj9c=)
28. [cleantalk.org](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGEElJiHZolPGd5sCWpk7oXhjOqIaaI0T8r6IkcrK7qFTTcEpQ62lIph7o5R-Q7YcE7qhctqomEt6JWBh1ea-AzTCb9Rga6D9gARx8Trcd32NmT2gRMfSUJs6vndhb6)
29. [abuseipdb.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHFOq1-2xahZXPTrjE4U4ONyLm46CDkJ4VfgkQTyF7HMU9R2k3uwbmBtwMj4_zGkC0gMajxqnsbay5cAQZht3XV5ENWsezBZjwJrVc7B0bhQLetKvRCW-XBvwoVoIaW1PwT77o=)
30. [criticalstart.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGU5bdofswDe79DG6KuKzn4eBs4vGO41xz_1QhbGWp54qc4tWQq0zYWdUdRCdQckNezLKbfmSlG6Gkoy_6yuXTiHSz3czNNAKaP8FcimiddGxcQh6ioabvLsoXu7YgJnA6tSN2rg1J0-bRcmQXavasdl1UOT8e0clR8HC7pmOdc15a0uGmCmAvlDz1JLZ8_gR61kHjCcKsRoepbjrvJCE1eXGj66jfByg==)
31. [abuseipdb.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFgx6n8YQyvv74Dhh1Lbt80wtOPmi64hqXCTxBazyzQRb-GLW55Xn4gJ56omKqzdk-PflA_QjBJkEXNln9q7ojxRxjgMWUNfQO4snJU9p2icCXyl6eCv9o3zlGNuikSFd2H_w==)
32. [bitsighttech.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFtmwA73ijrEzGJ_1mTIYT9nSGdLBI6RYAYED8UHA_yVXkjjg6nnpTh_LyHPc4ubLBeSJPkwLLQHdE1Qz2Jfa_oCVXq_YKLahHx7fmx8Swx4qhSdUToKM1eWl2wh96mZzGm0yAlSBXHKLKiHXnVftUttJXFqGWLw6J0KYzOyyUDO9pCOypke5b3nrRntJ2fHprCLOjUp1F3QRW4M8lu2DssBDAdQmF8Mdrs0bqp)
33. [digital.nhs.uk](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQE71E77UDNi5o7nt3tIHUVInX5T_bjRZgQGSbFtUBtSnHcUwPaOvPqQyEwS3m5LNfSrTu5MrDRpMo8_RwasSaJ9KJZDYyoy5jPoA7LCM5eh6pxF9Tou8K0VroBhYHEMLAngCspTAg==)
34. [github.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQE68CM8SRkQC2GjL8-0TuZOlahlW9VcajPb-YoobhdDTZyxiO4ct9FJdTZB_Wik4q60qpnikz_ALvJrGBYTr9fuBYJfokG7QT13bUOURj5G5xXzHaOg27tudvJsB_EK_dM=)
35. [ipthreat.net](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEcwWJyhOIbJV0d55CMb7MESWSXjqce0ZqebI9nl-TtrwkqHYGJ0YxjH2uwUzUNsHtOOgHVV7B60omnza-AA97kKu4woo7tfHg_hsVX6o142ILYmYGb8PMhSJAzDGVa7y65)
36. [bitsight.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFKoFCJE02sWt8BDjkNCnxxW3aR5yMPIH9EOP_mP7tbmGCSo83RL8VIhpSQIeP8xSvneruDvBYvzU5699BFQNoHOQks9LmP6KacXyGu7u3z-QHpnFN3_dHHUceqtxtFN9GAH4A1zVCtV43j79LdFeMvPlUalm8o9-X_2g==)
37. [abuseipdb.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQE7rJooDfr_-N1E14muWhWDmQb2tnUR5xvHw76wk2Xj2pTplW_jnWScNuYb_LV7kAWD6J4QmcxysN7-gl-5D36HgLDzGwmb-NAo4uYFkZ44xfpkKuE2rP1P1LIvJsbGXEleENrX)
38. [hostroyale.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQESqGzx2KdwpfvmcSS12kfHEhwKfoUjyfcXBi3pWYv18qpzauo_AW0-SoB6KO82qa4_7qwNzHCWtHFlJcwAxHUjfyhKKuN1G--NxqMrO5W_qEYEBJOgsUD1)
39. [cisco.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFYvh6tIm749GzeCuXiCbAMtohtCJjG4LP6F1-6aReRtx4u0CJhPSBcI9Yl08dZRzBy5ANil-eIYE6Yuw8Uv39Q2Vztpn5SdEY60z85M6irsJ80YwSqILnRhaVIFAASuPdVPii1desup6fHdaXk-6djV3ykewaB8KKFTW3KkXR8bCT7w-jiGnbmQRDHZbw=)
40. [digital.nhs.uk](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHTd0F6lKGtryHfOtNH0beuC6rGV9PU4c3lpUQs-iqDBLeXhrGkLQGM3LfMqRTMkP39tRoryCf8_fcHXwmZFM7xPD_Zmc-9W8IXYBBQWYs73iuzdaZlOwqofPi2En8Eg0sMYs1Gdw==)
41. [fortinet.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQE3S78cFRw0QqbPFApm7ahm_w0Tfag5wFRzGdqt246dMrokgBqEg1-EXlM5-wY727DqhT948PNFreA8du9Z_1BonZaY8Y0R7NBbibj4hyA2JzY5OwbTdMgfEZMzMSpyNIBFnpphWgxp-I0waGbIp3kuYhrFIUvUZDJXoiHdpqoWXomYyVVlI2RG2LEnrG7KB82yyA==)
42. [trendmicro.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQE1kqR8UBpeAeRpicCvHgn1qckggQ5magbdKyMjabDG46ob6wuW3LHhD-Pqs8hCXAA4f0cTv89b5NIltcsI9rYoSEy5PNesL3CT30vXl_fNeAbR5WE-GP1yET24AV4swIYTZxc66bfEekpQ5mX1P3J96Q==)
43. [github.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEsDVuGhJ0qwEGh-O691okGiiJ6YNSgjfvpqawiAi42ee30Hki197EDb5lzWAcJrDwQJfzD9jYPw1Fdib3tmoYL5NGMXcCz9tOVQrTx1URZOWSxWulSuTT7-IjRxmHAElg=)
44. [broadcom.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGb7e8ksmyrdlukqNqwkpYJaaJJJex-WI0y5UZHbdMI371B0d0mmgbasUP_okfhA4OKwtcLx3h-otFoAP6RMCSxgsgm0CCwzi-1vdSsNd8_MDtTfUgrzGiqjV3AJjPxpPH7kwVOAt-fNp6_uEFZRvUU86eRXid-5YF13IdBVTXS5UxOE_RQOhyk2VjJMkhB4ZMKiA==)
45. [cyberpress.org](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHDg-qb5H2tqSpVl5ms4Xjg5RFXbPCIxxLd5d3_Zs8yaZS7J4nz9LoZ2QWP4EfKIseGVCtnxj4_C9_LeIIvi2jUKpBSoOeCj06-42niRBzprWV-_FV-6d30RdphWbVBfQkq9ErQcqw107ZznhS-NWHiUHmdGjHoZh_Bv5OiXEdrhE1lnpMQvA==)
46. [sequretek.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEYVYwkljOCjdzIwuVxqBr7Q6A92kK2F_fvJFb0XEz8ajzf_QuW89d7Y17waJP3St6KgGVBI9K63pJ9ZlfPpUeG1jRJAsse-lQM8lDogOZ9rqNTAnzoan3Isaqm2bCN9t5bh20b1LVhKH9epL-sOJ0kg3UUSooCV4iHxvj87kFP09CVwMFeKksrN1cgAA==)
47. [ipthreat.net](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEKXphLoUzlt3XAmQu_gNrJTknURQ9QFDlZJxja4o1rjTiad-i2bbYva9ygZiCA0wUQE9rrt4BwdN9GTxRQSEpUfyPkYCuUl0rlwF5Nw-4yDSR2LZZaJ3Msf7P_ng_wZfo=)
48. [splunk.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQE8FHDMGvoITub1bv5kyB-UZ-QfYKeZVPwkUvXhbJwv8Fvfa-fGwUdP4fuXOvjwmrsnCrHjp8ImAgQ94Ka8azyiNQdQXnSPFoCAdOGGvyJXufi97cbsIUkzZ9oRlj3dQWrzPVaW)
49. [spotit.be](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEmRCk-gIzA0dz0VWQ6bcjZrfcpSslWw7FeUD6Qz-0pDxsiZQOnuEkZlWPoGpUoWh7JcrTD1qpyZelS8ogJqLHv4DX3239j4X8mIKKgKptpZVzaNtK-JTp9utN1Qu5gG_62pR8vEnL_qecR5QL74cML4NEH8YA=)
50. [ufl.edu](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQF2PXoSSmM72_F-BrPBeN8_UmsSHF6NBzSEGYQ-c9w73UPEHZLSwqDCGeeTqElWK1WkiQWd7iLFJrIqhVAniw_nk5nDx9V05blr5a70jkYYfIy5Vu7pRv6MzP_sHF9lHZhffPHRReehMr4mqiLWNRtBbuBF_LbTmhB57y7Jd-dITJHrto7cN-sSQoi4)
51. [google.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHGUudePVUwV1WAaWh_0tATxjmaVuCqyi2NfGmEUV2wq_25LApC3zRBWrBZZWxQi_kPzRIqwPe4t4R8fs00xq6MlpHcXzxMnFSLWK_FFALn7C1UVpnX6P8wF7pD5rLwK9akK5aJcIoa3ur3oyK7p8Pw9i4=)
52. [hackerone.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFXYZUVS4e-XtfPke8KtzaYtIQ_WBmijNeWf8sA5LLWgyQ2SAVbU269IvZPcfaaDzYjyJS_PCmZdVQ_dpilzZHbL7QAOrJY5loI7usQgAOGBIWothHULJjSew==)
53. [hackerone.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHs7NSumm92AM9Kg_-O4cAjtqaxs7ueCu5IkBalcXOm7M6cSkh8jS2IgJ4qQvzfAM507d56Bm46BZ-BcTKIdK9Q7NmwQnlyN2PsNwFs4RQojEwsgIxsqXdX2Ww=)
54. [github.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGxRU3qbsj9Qk0BMZTIhc8ZiDFvEI4zNJs41Y0pHcYvVe5WLcQJBHki9zODeWIq0PYxG-nqL0VfOLifmouIrfet018cS1LvZDNMBo_EZkMeV7htSBni434q_-Y70LiOUld40ckgSG-4mnZyCW3pupO_QdOyM7viBtEuj6CQWA==)
55. [scamalytics.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQG4DKHW2ZGgt1E-IKWrXxOoxrLTTZTnQgdnbZeRWX-6rT68oS4Iuyhg8AMqeUtY_H72XJediioj6lKIUvHbjP4i4LRioUCOkp9tRopP4jY7LE1duhJvPtIXay46A46ey9cUmhTsFZ8=)
56. [cleantalk.org](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQH5IGISdeAFSL5D845QeuQ_hIPn_VFsT1w7_BWf2tHTrJn_eMRBLD64rn-E6gJA-cg6nQdp9jhqbNIVNvXpfkJ9zQFd5NYfHR0kwaBxPhm7wPCjxmbqBVYw-rxi3Q0=)
57. [f5.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHdYEmqfwPEQeYVBMYxC0ItFZmMWivmed81kYtHMwOWdO4MtHXoBYtLXHQIB4ucucnomKa-N02JQ8GznYYPOog92u_ME4RMZFC_UkoGhy-VkuAjFy4_ggJU624fNrzbhraAQXKPAitnAjdrWRRKdpAbJTZvzfm6wKQdH-_sIHMxrudD3ztKZKvoc46JjkcAVDVUkSaeRYLI7eHEojDK5oqcJGg=)
58. [akamai.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQG3lB8R6FnZd_nYtkiHX4xbmO61FXZgopsVZ6HafARyw4A01arJvWHSfX1YO92p9FkwBTx8iI98fKqzkENkN0zNYqljR8DMXpvbxNES-UE5S6oaIZpViHnnq8y_Bq45zWWVxQWhj1g5RGFFqbkkhDKxiL0_6aD5b7lWMie4ccssehHQn9AyS7GUz8OvrfMAnQ==)
59. [csk.gov.in](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEzk8ljDV16LYB7OmK5LQ_Iq0TVXsrCcPTkTTgP_gb5WDh5Y56FeJcgkbGy8cKYkE6_qj5jJpmiqqL8M3fT5pYMqmmKNonlG8ATJLiZjZvOJ2WaKqCCyblKklgKSKxEjQs83jTEj3hB)