Multi-protocol malware trap catching everything.

# Dionaea Exploit & Malware Captures - NadSec - 2026-02

**Date:** February 28, 2026
**To:** Threat Intelligence Team, NadSec Cybersecurity Operations
**From:** Lead Threat Researcher
**Subject:** Comprehensive Threat Analysis of Dionaea Honeypot Activity (Sydney Sensor) - February 2026

## 1. Executive Summary

This report details the threat landscape observed by the NadSec Dionaea honeypot sensor deployed in Sydney, Australia, during February 2026. The sensor captured 6,074 unique threat indicators, predominantly characterized by automated brute-force attempts and service enumeration targeting critical network protocols.

**Key Findings:**
*   **SMB Protocol Dominance:** The Server Message Block (SMB) protocol (Port 445) accounted for **64.4%** of all observed traffic. This activity is heavily driven by residential and telecommunications infrastructure in Southeast Asia (Vietnam, Indonesia) and South America (Brazil), indicating the continued prevalence of wormable botnets such as Mirai variants and likely the emerging **Kimwolf/Aisuru** botnets active in early 2026 [cite: 1, 2].
*   **Database Extortion & Compromise:** A significant portion of traffic (19%) targeted database services (MSSQL port 1433, MySQL port 3306, MongoDB port 27017). High-volume scanning from cloud hosting providers, particularly DigitalOcean and Google Cloud, suggests compromised cloud instances are being weaponized to hunt for insecure databases for ransomware or data extortion campaigns [cite: 3, 4].
*   **Critical Infrastructure & APT Overlap:** The detection of activity from **UCLOUD INFORMATION TECHNOLOGY HK LIMITED (AS135377)** is of high concern. This ASN has historically been linked to state-sponsored threat actors, including **UNC3886** (China-nexus) and **Kimsuky** (North Korea-nexus) [cite: 5, 6]. The presence of this ASN in a honeypot environment suggests either non-targeted automated scanning by these groups or the commercial leasing of their infrastructure to lower-tier cybercriminals.
*   **Bulletproof Hosting Activity:** Indicators associated with **Nice IT Services Group (AS49447)** and **M247** were observed. These networks are frequently associated with "bulletproof" hosting, providing resilience for malware distribution and Command and Control (C2) operations [cite: 7].

The threat landscape for February 2026 in the Oceania region is defined by a dichotomy: a high-volume background noise of automated botnets exploiting legacy vulnerabilities (SMB/IoT), overlaid with targeted, infrastructure-savvy scanning for database assets likely intended for extortion.

---

## 2. Statistical Overview

The following statistics are derived from the full dataset of 6,074 indicators captured between February 1, 2026, and February 28, 2026.

### 2.1. Top Targeted Services (Ports)

The overwhelming focus on Port 445 indicates that the propagation of worm-like malware (leveraging exploits such as EternalBlue or brute-forcing weak SMB credentials) remains the primary threat vector for exposed infrastructure.

| Port | Service | Count | Percentage | Primary Threat Context |
| :--- | :--- | :--- | :--- | :--- |
| **445** | SMB | 3,914 | **64.44%** | Worm propagation (Mirai/Kimwolf), Ransomware lateral movement |
| **1433** | MSSQL | 482 | 7.94% | Brute-force for BlueSky Ransomware, Proxyware installation |
| **3306** | MySQL | 353 | 5.81% | Database compromise, Web shell injection |
| **21** | FTP | 301 | 4.96% | Credential stuffing, Malware upload |
| **27017** | MongoDB | 296 | 4.87% | Data extortion, Database wiping (Ransomware) |
| **81** | HTTP-Alt | 225 | 3.70% | IoT Botnets (Mirai variants), Camera exploitation |
| **1723** | PPTP | 196 | 3.23% | VPN Brute-force, Legacy access attempts |
| **135** | RPC | 148 | 2.44% | Reconnaissance, Distributed Computing Environment attacks |
| **1883** | MQTT | 133 | 2.19% | IoT messaging protocol exploitation |
| **Other**| Various | 26 | 0.42% | High ports (ephemeral), legacy services |

### 2.2. Attack Distribution by Infrastructure Type (Sample Analysis)

Analysis of the 800 sampled IOCs reveals a distinct segmentation of attack sources based on the targeted port.

*   **Residential/Telco ISPs:** The vast majority of **Port 445 (SMB)** attacks originate from dynamic IP ranges assigned to major telecommunications providers in Vietnam (**VNPT, Viettel**), Indonesia (**Telkom Indonesia**), and India (**Bharti Airtel**). This confirms a residential botnet architecture.
*   **Cloud Hosting:** Attacks against **Port 27017 (MongoDB)** and **Port 1433 (MSSQL)** are disproportionately sourced from cloud providers like **DigitalOcean** (US, DE, NL), **Google Cloud** (US, BE), and **Tencent/Alibaba** (CN, SG). This suggests attackers are compromising cloud droplets to use their high bandwidth for rapid internet-wide scanning.
*   **Bulletproof/Opaque Hosting:** A subset of attacks, particularly on **Port 3306 (MySQL)** and **Port 1723 (PPTP)**, originates from ASNs with poor reputation scores, such as **UCLOUD (AS135377)** and **Nice IT Services (AS49447)**.

---

## 3. Infrastructure Deep Dive

This section analyzes specific high-risk autonomous systems (ASNs) and IP clusters identified in the dataset.

### 3.1. High-Risk ASN: UCLOUD INFORMATION TECHNOLOGY HK LIMITED (AS135377)
**Associated IPs (Sample):** `118.193.33.249`, `152.32.128.149`, `152.32.200.117`, `165.154.129.188`, `156.229.16.165`, `118.193.47.223`, `101.36.97.187`
**Targeted Ports:** 1433 (MSSQL), 3306 (MySQL), 1883 (MQTT), 27017 (MongoDB), 1723 (PPTP), 21 (FTP), 81 (HTTP)

**Analysis:**
The presence of **AS135377 (UCLOUD)** is a critical indicator. Threat intelligence links this ASN to sophisticated state-sponsored activity.
*   **China-Nexus Espionage (UNC3886):** Mandiant has tracked the threat actor **UNC3886** utilizing UCLOUD infrastructure to conduct espionage against defense and industrial bases. This actor is known for exploiting zero-day vulnerabilities in Fortinet and VMware technologies [cite: 5, 8]. The detection of UCLOUD IPs scanning for **Port 1723 (PPTP)** and **Port 21 (FTP)** in the NadSec honeypot could represent the automated reconnaissance phase of such an actor, or a "living-off-the-land" strategy where they utilize commercially available VPSs that are also popular with cybercriminals.
*   **North Korean Activity (Kimsuky):** Infrastructure within this ASN has also been linked to the **Kimsuky** APT, specifically in campaigns targeting South Korean portals (Naver) and utilizing "Million OK" HTTP response markers [cite: 6].
*   **Dual-Use Nature:** While linked to APTs, UCLOUD is also a hosting provider. The diversity of ports attacked (including IoT ports like 1883 and 81) suggests that parts of this IP space are likely leased to non-state criminal botnets or are compromised by common malware. The traffic observed here is likely *automated scanning* rather than a targeted campaign against NadSec specifically, but it underscores the high risk associated with allowing traffic from this ASN.

### 3.2. Bulletproof Hosting: Nice IT Services Group Inc. (AS49447)
**Associated IPs:** `45.9.149.201`
**Targeted Ports:** 1433 (MSSQL)

**Analysis:**
Traffic from **Nice IT Services Group** is almost famously malicious. This provider is frequently flagged in threat intelligence reports for hosting malware control servers, phishing sites, and brute-force infrastructure [cite: 7, 9].
*   **Behavior:** The IP `45.9.149.201` executed **37 events** against the honeypot's MSSQL service. This high event count from a single IP indicates a persistent brute-force attempt, likely attempting to guess the `sa` password.
*   **Malware Link:** Infrastructure in this subnet (45.9.x.x) is often used to host payload delivery URLs for commodity malware like RedLine Stealer or ransomware loaders [cite: 10, 11]. The attack on MSSQL likely aims to enable `xp_cmdshell` to download such payloads.

### 3.3. The Cloud-Based Database Hunters (DigitalOcean, Google, Alibaba)
**Associated IPs:** Hundreds, e.g., `167.172.147.25` (DigitalOcean), `3.132.23.201` (Amazon), `47.250.81.7` (Alibaba).
**Targeted Ports:** 27017 (MongoDB), 1433 (MSSQL).

**Analysis:**
A distinct pattern emerged where cloud infrastructure was used disproportionately for database targeting.
*   **DigitalOcean (AS14061):** This was the primary source for **MongoDB (27017)** attacks. For instance, IP `137.184.144.251` triggered 31 events. This suggests compromised droplets are being used to scan for open MongoDB instances to execute ransom scripts (wiping data and leaving a `WARNING` table) [cite: 4, 12].
*   **Google Cloud (AS396982):** IPs from Google Cloud (e.g., `35.203.211.149`) were seen targeting MSSQL. While Google monitors for abuse, the sheer scale of their infrastructure makes them a prime territory for attackers to spin up ephemeral instances for rapid scanning before being banned.
*   **Implication:** Defenders cannot simply "trust" cloud ASNs. The volume of attacks from these high-reputation networks confirms they are actively weaponized for reconnaissance.

### 3.4. Residential Botnet Swarms (Port 445)
**Associated ASNs:**
*   **VNPT (Vietnam - AS45899):** Extremely high volume of IPs (e.g., `14.232.152.193`, `113.180.210.216`).
*   **PT Telkom (Indonesia - AS7713):** (e.g., `125.160.159.9`).
*   **Bharti Airtel (India - AS9498):** (e.g., `182.79.210.66`).
*   **Telefonica (Brazil/Argentina/Peru):** (e.g., `187.57.182.32`).

**Analysis:**
The sheer volume of unique IPs from these residential ISPs targeting Port 445 is the hallmark of a self-propagating botnet.
*   **Mirai / Kimwolf Context:** In early 2026, threat intelligence reports highlight the **Kimwolf/Aisuru** botnets, which target insecure IoT devices and residential routers [cite: 1, 2]. These botnets often utilize SMB exploits (like EternalBlue variants) or brute-force to move laterally.
*   **Infection Cycle:** The infected routers/devices at these residential IPs are autonomously scanning the internet. When they hit the NadSec honeypot, they are looking for other vulnerable SMB services to infect. This traffic is "background radiation" but dangerous if it encounters an unpatched Windows host.

---

## 4. Malware Analysis & Campaign Attribution

Although no binary payloads (hashes) were captured in this specific sample window, the *behavioral* patterns allow for high-confidence attribution to specific malware families and campaign types.

### 4.1. Campaign A: The "Kimwolf" & SMB Botnet Swarm
**Indicators:** Port 445 (SMB) traffic from Residential ISPs (VN, ID, IN, BR, RU).
**Attribution:** **Mirai Variants / Kimwolf / Aisuru Botnets**.
**Context:**
As of 2026, botnets like **Kimwolf** and **Aisuru** have evolved to exploit a wide range of consumer devices, including Android TV boxes and poorly secured routers [cite: 1]. The behavior observed—massive, distributed scanning for SMB—is consistent with these botnets trying to propagate. The "flat distribution" of requests (often 4-5 events per IP) indicates a scripted, automated "fire-and-forget" scanning methodology [cite: 13].
*   **Mechanism:** These bots likely attempt to exploit vulnerabilities like MS17-010 (EternalBlue) or perform dictionary attacks on SMB login.
*   **Threat:** If successful, the device joins the botnet, contributing to the DDoS capabilities observed in recent 30+ Tbps attacks [cite: 2].

### 4.2. Campaign B: The Database Extortionists
**Indicators:** Port 27017 (MongoDB) and 1433 (MSSQL) traffic from Cloud VPS (DigitalOcean, Alibaba).
**Attribution:** **Opportunistic Ransomware Groups (e.g., Harak1r1 copycats, BlueSky)**.
**Context:**
The specific targeting of MongoDB on port 27017 is a continuation of the "Mongolock" style attacks.
*   **MongoDB:** Attackers scan for unauthenticated instances. Upon connection, automation scripts wipe the database and replace it with a ransom note collection [cite: 4, 12]. The high event count from single IPs (e.g., `134.209.0.5` with 34 events) suggests the attacker is not just checking connectivity but attempting to list databases or inject commands.
*   **MSSQL:** Brute-force attacks on port 1433 are the standard precursor for deploying **BlueSky Ransomware** or cryptominers (like **LemonDuck** or **KingMiner**) [cite: 14]. The attackers use `xp_cmdshell` to execute PowerShell commands, downloading payloads from bulletproof hosts (like those in AS49447).

### 4.3. Campaign C: The "Proxyware" Parasites
**Indicators:** Port 1433 (MSSQL) and 445 (SMB).
**Attribution:** **Proxyware Installation Scripts**.
**Context:**
Threat actors are increasingly compromising servers not to destroy data, but to monetize bandwidth. By brute-forcing MSSQL, they install "proxyware" applications (like Honeygain or IPRoyal) effectively turning the victim into a node in a residential proxy network [cite: 15]. This allows other criminals to route traffic through the victim's network, masking their origins. The NadSec sensor likely intercepted the scanning phase of this monetization strategy.

---

## 5. MITRE ATT&CK Mapping

The observed activities map to the following MITRE ATT&CK techniques:

| Tactic | ID | Technique | Observed Behavior |
| :--- | :--- | :--- | :--- |
| **Reconnaissance** | **T1595.002** | Active Scanning: Vulnerability Scanning | Automated sweeping for open ports 445, 1433, 27017 across the subnet. |
| **Reconnaissance** | **T1590.005** | Gather Victim Network Information: IP Addresses | Identification of live hosts within the NadSec IP block. |
| **Resource Dev** | **T1583.003** | Acquire Infrastructure: Virtual Private Server | Use of DigitalOcean, UCLOUD, and Nice IT VPS for scanning infrastructure [cite: 16]. |
| **Initial Access** | **T1190** | Exploit Public-Facing Application | Attempts to exploit vulnerabilities in SMB (EternalBlue) or MongoDB (misconfiguration). |
| **Initial Access** | **T1110.001** | Brute Force: Password Guessing | Repeated login attempts against MSSQL (sa) and MySQL (root) accounts. |
| **Execution** | **T1059.001** | Command and Scripting Interpreter: PowerShell | (Inferred) Use of `sqlps.exe` or `xp_cmdshell` on MSSQL successful compromise [cite: 17]. |
| **Impact** | **T1485** | Data Destruction | (Inferred) Wiping of MongoDB databases in extortion attacks [cite: 4]. |
| **Impact** | **T1496** | Resource Hijacking | (Inferred) Installation of cryptominers or proxyware on compromised hosts [cite: 15]. |

---

## 6. Detection & Mitigation Strategies

Given the prevalence of botnet scanning and database targeting, the following defensive measures are recommended for NadSec and its constituents.

### 6.1. Network Defenses
*   **Geo-Blocking & ASN Filtering:** Consider blocking or strictly rate-limiting ingress traffic from high-risk ASNs identified in this report, specifically **AS135377 (UCLOUD)** and **AS49447 (Nice IT)**, unless business requirements dictate otherwise.
*   **Port Hardening:**
    *   **Port 445 (SMB):** Block all inbound SMB traffic from the internet. If external access is required, enforce VPN usage.
    *   **Database Ports (1433, 3306, 27017):** Never expose these interfaces directly to the internet. Use SSH tunnels or VPNs. If public access is unavoidable, restrict source IPs to known management subnets using firewall allow-lists [cite: 18, 19].

### 6.2. Detection Signatures (Snort/Suricata)
Deploy signatures to detect the specific scanning patterns observed:

```bash
# Detect Scanning from UCLOUD ASN (Example rule logic)
alert tcp $EXTERNAL_NET any -> $HOME_NET  (msg:"ET SCAN Suspicious Database Scan from UCLOUD ASN"; flow:established,to_server; content:"|00|"; depth:1; reference:url,cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations; classtype:attempted-recon; sid:1000001; rev:1;)

# Detect MongoDB Ransom Note Indicators (Inbound)
alert tcp $EXTERNAL_NET any -> $HOME_NET 27017 (msg:"ET DB MongoDB Ransomware Activity (WARNING Table)"; flow:established,to_server; content:"WARNING"; nocase; content:"BTC"; distance:0; classtype:attempted-admin; sid:1000002; rev:1;)
```

### 6.3. Threat Hunting Queries
**SIEM Query (Splunk/Elastic):**
Search for connection attempts from the identified high-risk ASNs or involving the top targeted ports.

```splunk
(dest_port=445 OR dest_port=1433 OR dest_port=27017) 
AND (src_ip_asn="AS135377" OR src_ip_asn="AS49447" OR src_ip_asn="AS14061")
| stats count by src_ip, dest_port, src_ip_asn_org
| sort - count
```

---

## 7. IOC Appendix

### 7.1. Top High-Risk IP Addresses
The following IPs exhibited significant malicious behavior (high event counts or association with high-risk infrastructure).

| IP Address | ASN | Org | Country | Target Port | Context |
| :--- | :--- | :--- | :--- | :--- | :--- |
| **113.180.210.216** | AS45899 | VNPT Corp | VN | 445 | **Top Attacker (3,158 events).** Massive SMB brute-force/scanning. Likely Botnet C2 or infected super-node [cite: 20]. |
| **103.77.48.249** | AS55699 | PT. Cemerlang Multimedia | ID | 445 | High volume SMB scanner (456 events). |
| **45.9.149.201** | AS49447 | Nice IT Services | NL | 1433 | Bulletproof hosting targeting MSSQL. High risk of ransomware loader. |
| **134.209.0.5** | AS14061 | DigitalOcean | US | 27017 | Heavy MongoDB scanner (34 events). Potential compromised instance. |
| **137.184.144.251** | AS14061 | DigitalOcean | US | 27017 | Heavy MongoDB scanner (31 events). |
| **118.193.33.249** | AS135377 | UCLOUD | HK | 1433 | APT-linked ASN scanning MSSQL. |
| **152.32.128.149** | AS135377 | UCLOUD | HK | 3306 | APT-linked ASN scanning MySQL. |
| **95.167.166.18** | AS12389 | Rostelecom | RU | 1433 | Russian ISP scanning MSSQL (12 events). |
| **123.234.81.180** | AS4837 | China Unicom | CN | 3306 | Chinese ISP scanning MySQL (10 events). |

### 7.2. Observed High-Risk ASNs (Watchlist)
*   **AS135377** - UCLOUD INFORMATION TECHNOLOGY HK LIMITED (Espionage/APT links)
*   **AS49447** - Nice IT Services Group Inc (Bulletproof Hosting)
*   **AS14061** - DigitalOcean (High volume of compromised scanning nodes)
*   **AS45899** - VNPT Corp (Major source of SMB Botnet traffic)

---

## 8. Sources & References

*   **[cite: 1]** Barracuda. (2026, January 29). *Malware Brief: New wave of botnets drives DDoS chaos*.
*   **[cite: 2]** The Hacker News. (2026, February 05). *AISURU/Kimwolf Botnet Launches Record-Setting 31.4 Tbps DDoS Attack*.
*   **[cite: 5]** Google Cloud Threat Intelligence. (2024, June 18). *Uncovering UNC3886 Espionage Operations*.
*   **[cite: 6]** Hunt.io. (2024, December 10). *Million OK: Naver Facade & Kimsuky Tracking*.
*   **[cite: 7]** DomainTools. *Patterns of Malicious Infrastructure Report*. (Identifying Nice IT Services as malicious).
*   **[cite: 17]** BleepingComputer. (2022, May 18). *Microsoft warns of brute-force attacks targeting MSSQL servers*.
*   **[cite: 15]** SOC Prime. (2022, August 03). *Adversaries Hack Microsoft SQL Servers to Install Proxyware*.
*   **[cite: 4]** TechRadar. (2026, February 02). *MongoDB instances are being hit in data extortion attacks*.
*   **[cite: 3]** Dark Reading. (2017, January 10). *MongoDB Attack Shows Off Cyber Extortionists' New Tricks*.
*   **[cite: 13]** NadSec Medium. (2025, August 29). *Honeypot Report: A Coordinated Reconnaissance Wave*.
*   **[cite: 20]** PMC. (2021, April 01). *Analysis of Dionaea Honeypot Trends*.

---
*Report generated by NadSec Threat Intelligence Team.*

**Sources:**
1. [barracuda.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHMsot3HTGlYSfOir1XDPnMusXUBgDDjzpgZXVpvePKtmv3s-k-zMg3EZQdF1-h8UU9NrMNSdhDL6bBU7OXH0MIl8eIlnhplgq0gSzxHrKo_x1rA0i1nUNsLg7rz9g6SWCekg8MrmWzSmUordfmswZAJSDj40Jm00pnMZxMgMNB_7MGNgdT)
2. [thehackernews.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGs-AmegCfoqkwlgDemk0n4qF4DVuSioA9WGU3Qi0cC0194ML7_LtkXkOTESeHU2nbkbfJDfFOrDhV_VpKdcOcMhhInoOeBgQ4V-l93CakDov4-MEbhtkcmxCr44jNSGjUHMZNlIjnWX4ZB6wHDmPHwC01Ju-qGBhLZSNJ_6zvL_ew=)
3. [darkreading.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEbduVYQKiDcox-O-mwcFxoC-HdCcejJAqOENlQNPyD7yGmA16uWpPvl842bkToZ32HT1btLZ1T2A9vtSwnopABDo7WoNZubL_53VyXdWDabB2bcC6KmOInvpx3YR3UODSwqrTJKNhDurKtUCi3EFxSjPcbipxDST0UUATL_9vr_fbbdVxT6AmN2tvW8QmU7dOLdNKd_VZ74lfH4D4KYAq1iZ0TCA==)
4. [techradar.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQF87G5n7nTeV_bBaoe0POvXKW0x4G6YDiQvrTqoYxy0puX-fjHrjVKJiQTcGGKtsTd8kcortKyDQBS3S2PvqFu-sGZi5zO39jZjlmLZn9-IHH0DVI6wbKEmDgZXgX1H02357I04rZS2nRSoBluGAjwpKAf5HpUi0NQZkDjZb-FosaIsXG0I9CYoX9j9ew8cX4HmjcmxiExzlSisF88fFo299C8MnfynehzfmSfEqVxlwVctng==)
5. [google.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEUX10mbMzPMC6gJWjb2k8qXC1miBUSa1Ar71dMuUJJ_r5P_izn_6scVFIhLEtSTQVMqjx4ljPLzBei3T9fVo8J8hKEF3TPYPmml0pmHgC44SXtlT2JW4edZn36XA3yQgX9guBphNyy2qEVBajzmJmVeSLyHFSchfo-C9VTxUZ_A1Wwt_D2gTHdv_J-9fyikjTbmS5UMtU=)
6. [hunt.io](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFj3T5Q2qcB45HEY7EaW1dWE0lVthfqsREUVB7P3XjRvbKjZrM-XAxW8F8YKY_XWu5fH41L79B4WIUaIpOWXIeEw01lztJN4HcDNBO8GHYaQELoBoUbJDXpFonVXc8I6J1xPjGL3RAbRguJv2xX2oq5z5kF)
7. [website-files.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGqYJfFxUaSY8H36u-owCI1SraOwk4PmbdzrFoNHQuLLEQ1O_GbZmg616YuSPmG7oe4IbApF2z3Jb1wmqmValW2G3L9_bfYglFfH0l31kxy1D6VgR27dOK0xXRue1O2cFAwSYR8fWqfsxp2AeBOhx0vtbPp1HOV26RCwXxvsTB5Kq1RvmRTMQ16mmnoz7yBHkHflqM1etMmAJF1VXriDiRL2msDKmcQprOgAEGJKhDAT2Ow_RJ8zM2PpavhutQwLJeBnP2VxNbL)
8. [gbhackers.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEMNc13B36rhGOtBAbx7MRnpra0GEvyTD7olvjBi3Fk5kBemWMVfI7n8VvQU6BIQPPvrZ5_z21RzYIoek1zod61Dl8fuJO76uxgptjTXYdmShon6t7vE6ZR8GO2KKHPTHt7UG_XjzbUePcPgXI=)
9. [gridinsoft.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFMw6eHqgWMsOf3WgWOz0WvHUz60_kR3GupdaXXkorGaB6fZr9h-z7bbeUBgUAq0XYRmS-yv3YZgr69GD5DTnpc9Gbqo43qeNa9IuTpNsnWZDEygjypFlZTcaX8ktGdfwpSWeY9FzqAIpcmb07hdQt3IQ==)
10. [gridinsoft.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEnKaOjHsEuhq2MdD4vNPeTpo64kbxKV2p7MtZNASIAGzJoD7cYftF3eaQhF6SDcHS9VAdP2oj6Jo_GZjK6SL0enPTPUntUcMZRs5t_YtGdJtOOmgLOWSkpI1T-LDI7phEv5kr-wwLjtOgyRidmvxlSURU=)
11. [gridinsoft.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGI51HaDksy_p-nKbgfo1ICoVrZE9YtVc2l8_1xqR6-uHCOukBh7Bty5fFwW0WTk_YpgWulTTUej8wXwVRqoyCGZe4Y30nZ_Lux15O1Y8EuoyiH48JerqoOga0KF-tPtlFSDOTgPapTFExnuLzxPlU=)
12. [thehackernews.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQH-rvcDGWwi5jDvqxpFjbAKXNDheFbWuRKH_FrZhqfjii9XPpf5K6AghQEa7Hnea5Q1XhwROse84bgWFMNQe4A3DM5kBXsT9osRVzhE7auViW2s1tkl_OwUxUj9sB-bbOODcsJPmVcYMOv-zXxX7gfgttxh0w==)
13. [medium.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQF_zahArGIPsKGn8EGKoPGsxu0KrQwbOb8MmvpEnEBaU9gTB-3l9Y69wJovp_Ad-LFUd54-QWopF5J9j0F2v-sBWXFu3JsAhOTiqawf2t4eXKK-7a1ClAp4FjIkSiqKpBXEx8O23sBxVFoImFtZWD9KDNq1sn9PzT8m2qk3E_UIHvtSUOZaYUQ_LAxjV2KiehL4yFhVHawyaVsYvxca96orIUsN1Z7kTNnQM9RE)
14. [thedfirreport.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGU3_h3P76XGUzU6J84laseNrTEMwCyrS-cOFqKJof3igdt9oe07LaC5Yj-zfLYZWhPXLhcEo7fRyizqWIaWU6JNBlrIvscHFTjj0bVGxwC7xqAAzWZZBpSgcXPgyTqj87IuNBK5Z3kYK0Jwn8U96vVoSeYyZ5SHLVPN5CJkzj38OQ0-7vLONQ=)
15. [socprime.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEoPtBKKYB8MJQb-ZiK0vQizBiKN7PY7VAQZBUMu7i4amrNc9m8RdOa_8Pfm9ia3zUL59LFZeSdUVvzZ8ct2bKdWbjXLYK5-iGYiSECCzj1DxYkHsaq-zRVaBV0QcYGT_0OftAGU2A9U2mFRtNWEcxkD8QSGWxEODeTN5w014fXlaVy0gS2glS7WKm-EdC601gPjXKN1TiWQQqn2vGYvCxk)
16. [socradar.io](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGUWrHdURh4EtrEBGUnTfBLeIIiVg84k8-rB36k9S6vW8AZvkN_F2meTyOaG8VifOfK6bqrA-9dc0cxcxNTZ8wqP35kuu72pT2D8rqZnPxjM-IZSOrPp4ttV8nusWrqx3eykQ6zMWMxbf03)
17. [bleepingcomputer.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQH3xNpbBD_fOl6zZ-UhoItoL_DspM6m9QQJl2Ft_v57JYA8aT6Vy1XqsS4aOh-fiNuLDuIbljJdpS1FuU9rZB8BnRIRQHgNs7LvJ71u_dSocr49GncBc5UZ2eSuicuDa1Vesdpp7Qnnyrj7u17n2nRHJcJPM99qR5EUs1j7BeAk7_ILsPc8kLyLOjJxd2T8JHFGwRGZ5tXFKQ69uanOJu_qS49_hg==)
18. [digitalocean.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFppDKVqgEbY7MklTLG5X3pr66rrto6oX9On-j2azG3H5gVno-CDZqDL1oZhc181YgpBTJSAy43oKFuUXwmTbt7Nr31jCQrTQ2LHUVaq_lEs9XMb6q38SXxsfsfY8TnRt0DOXlGLLbVycSMDH2kPHDjbD9OEPm_dUxGOXbRTg==)
19. [security.gov.uk](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQH0XiBaj0Xe_iWdICvrUBacFLH4JyOeAFrhfrgxI44KOZLKNtCqIgGG_AhcbAfr_B5BoeHKNGc0yT5hDsowMOt-ku1NLCA6O4ES1A8JO-A-o3lK2dHF0ouYRy-4lnr8f1ctV6lHLHhKbMr8VNHLsFI9nNTYmQPg8JsPN9OBFy670Ws95uigMSlADUmVKesnlHDHraxPVNzmpphKLQsDb06pyG-QZrh3sEY5rECD5PzF08H2jeeQJzYErUISdesrcAPrI7g=)
20. [nih.gov](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQE1aH4l2HP4rvG9vNgJ_HvGmCDCQCcqU3PCM_JisTmCqpEsGPxnaQr_bF26Rjy2uHcwrPC528DCwh1j7P_pD_ApyZ3pvXXXK9IjkqhiTNVLVbUZ5wjDKcjrRvzn6jyqTTOck1AMVn8j)