SSH & Telnet traps catching credential stuffing.

# SSH & Telnet Brute Force Intelligence - NadSec - 2026-02

**Date:** February 28, 2026
**Security Classification:** TLP:AMBER
**Author:** NadSec Threat Intelligence Research Team
**Context:** NadSec Sydney Sensor (Heralding + Cowrie)

## Executive Summary

This report details a comprehensive analysis of SSH and Telnet brute-force activity observed by the NadSec honeypot infrastructure in Sydney, Australia, during February 2026. The dataset, comprising 5,473 unique indicators and over 640,000 total attacks, reveals a highly active and diverse threat landscape dominated by automated botnets, opportunistic cloud abuse, and targeted infrastructure scanning.

**Key Findings:**
*   **Dominant Campaign (Outlaw/Shellbot):** A significant portion of the attack volume is attributed to the **Outlaw** (also known as Shellbot or Dota) botnet. This is evidenced by the specific command signature `cd ~; chattr -ia .ssh; lockr -ia .ssh` and the deployment of the "mdrfckr" SSH key. This campaign targets Linux servers for cryptocurrency mining and persistence [cite: 1, 2].
*   **Infostealer & Proxy Operations (GhostSocks/LummaC2):** We observed highly specific commands targeting Telegram Desktop session data (`locate D877F783D5D3EF8Cs`). This activity is strongly linked to modern infostealers like **LummaC2** and the **GhostSocks** proxy malware, suggesting compromised machines are being converted into residential proxies for further abuse [cite: 3, 4, 5].
*   **Infrastructure Targeting (n8n & IoT):** A novel trend observed in February 2026 is the explicit targeting of **n8n** workflow automation instances, with "n8n" rising to become a top targeted username [cite: 6]. This co-occurs with persistent **Mirai** and **Gafgyt** activity targeting legacy IoT devices (Polycom phones, Dahua DVRs) using credentials like `345gs5662d34` [cite: 7, 8].
*   **Bulletproof Infrastructure:** A subset of attacks originates from networks known for hosting malicious content, specifically **Omegatech LTD (AS202412)** and **Servers Tech FZCO (AS216071)**. These providers are linked to the hosting of the GhostSocks infrastructure and other malware-as-a-service (MaaS) platforms [cite: 5, 9].
*   **Massive Cloud Abuse:** The vast majority of source IPs belong to **DigitalOcean (AS14061)**, indicating widespread compromise of cloud instances or the fraudulent creation of droplets for scanning purposes.

The following sections provide an exhaustive technical breakdown of these threats, mapping infrastructure to specific threat actors and offering detailed mitigation strategies.

---

## 1. Statistical Overview

The analysis of 5,473 unique indicators reveals distinct patterns in attacker origins and methodologies. The data reflects a dichotomy between compromised legitimate infrastructure (cloud/residential) and dedicated bulletproof hosting used for command and control (C2).

### 1.1 Top Source Countries
The geographical distribution shows a heavy concentration in Western cloud hubs and regions with high densities of vulnerable IoT devices.

| Country | Count | Primary Abuse Type |
| :--- | :--- | :--- |
| **United States** | 147,539 | Cloud Abuse (DigitalOcean, Google, Amazon), Residential Proxies |
| **Netherlands** | 181,293 | Cloud Abuse (DigitalOcean), Bulletproof Hosting (Omegatech, Servers Tech) |
| **South Korea** | 38,446 | Compromised Residential/Commercial Fiber (Korea Telecom) |
| **Romania** | 28,391 | Bulletproof/Abuse-Tolerant Hosting (Unmanaged Ltd) |
| **India** | 26,551 | IoT Botnets, Compromised Broadband |
| **Vietnam** | 26,526 | IoT Botnets (Viettel, VNPT) |
| **Germany** | 22,347 | Cloud Hosting, Residential Proxies |

### 1.2 Top Autonomous Systems (ASNs)
The ASN data highlights the "supply chain" of the attacks: compromised cloud instances provide volume, while niche hosting providers offer resilience.

| ASN | Organization | Category | Notes |
| :--- | :--- | :--- | :--- |
| **AS14061** | DigitalOcean, LLC | Cloud Provider | Primary source of brute-force scans. Likely compromised droplets. |
| **AS47890** | Unmanaged Ltd | Hosting | High-risk Romanian provider. Known for abuse tolerance [cite: 10]. |
| **AS4766** | Korea Telecom | ISP | Residential/Commercial compromised devices (Mirai/Gafgyt). |
| **AS202412** | Omegatech LTD | Hosting | Offshore/Bulletproof characteristics. High abuse confidence [cite: 11, 12]. |
| **AS7552** | Viettel Group | ISP | Vietnam-based IoT botnet activity. |
| **AS216071** | Servers Tech Fzco | Hosting | Linked to GhostSocks malware infrastructure [cite: 5]. |

### 1.3 Top Credentials & Commands
The credential and command frequency provides direct insight into the specific botnets active during this period.

| Type | Indicator | Associated Threat |
| :--- | :--- | :--- |
| **Username** | `n8n` | Targeting self-hosted n8n workflow automation tools [cite: 6]. |
| **Username/Password** | `345gs5662d34` | Polycom CX600 default credential. Signature of Mirai/Gafgyt variants [cite: 13]. |
| **Command** | `lockr -ia .ssh` | **Outlaw/Shellbot**. Attempts to make SSH keys immutable for persistence [cite: 14]. |
| **Command** | `locate D877F783D5D3EF8Cs` | **Infostealers**. Scans for Telegram Desktop session files [cite: 15]. |
| **Command** | `/ip cloud print` | **MikroTik** router exploitation attempts [cite: 16]. |

---

## 2. Infrastructure Deep Dive

This section classifies the observed infrastructure to aid in attribution and risk assessment. We distinguish between "unwitting participants" (compromised cloud/residential IPs) and "purpose-built infrastructure" (bulletproof hosting).

### 2.1 Bulletproof & Abuse-Tolerant Hosting
A critical subset of IPs originates from networks specifically marketed to or frequented by cybercriminals. These networks often ignore abuse reports and provide stability for C2 operations.

*   **Omegatech LTD (AS202412):**
    *   **Activity:** SSH brute force and likely C2 hosting.
    *   **Context:** Registered in Seychelles but operating out of the Netherlands. This provider has a reputation for hosting phishing and malware C2s. The specific subnet `45.132.180.0/24` (and others announced by them) is frequently flagged for high-volume abuse [cite: 11, 17].
    *   **Assessment:** Traffic from this ASN should be treated as hostile by default.

*   **Servers Tech FZCO (AS216071):**
    *   **Activity:** SSH scanning and malware distribution.
    *   **Context:** Based in the UAE (Dubai) but with infrastructure in the Netherlands and Russia. This ASN is strongly linked to the **VDSina** hosting brand.
    *   **Malware Link:** Research explicitly links this ASN to the hosting of **GhostSocks** relay servers and C2 infrastructure [cite: 5]. The presence of IPs from this ASN in our dataset correlates with the observation of GhostSocks-related commands (see Section 3.2).
    *   **Assessment:** High-probability C2 or proxy node hosting.

*   **Unmanaged Ltd (AS47890):**
    *   **Activity:** High-volume SSH scanning.
    *   **Context:** A UK/Romania-based entity often associated with "unmanaged" dedicated servers. It consistently ranks high on abuse lists for port scanning and brute-force attacks [cite: 10, 18].
    *   **Assessment:** Likely used as a "blasting" platform for initial access scanning due to lax egress filtering.

### 2.2 Cloud Abuse (The "Gray" Infrastructure)
The vast majority of attacks originate from **DigitalOcean (AS14061)**, **Google Cloud (AS396982)**, and **Amazon AWS (AS16509)**.
*   **Mechanism:** These are not typically the attackers' own servers. They are likely:
    1.  **Compromised Instances:** Legitimate servers infected by the very botnets discussed here (Outlaw, Mirai) and repurposed to scan for new victims.
    2.  **Fraudulent Accounts:** Instances spun up using stolen credit cards for short-term scanning campaigns before being banned.
*   **Attribution:** The sheer volume from DigitalOcean (315,000+ events) suggests a worm-like propagation where infected DigitalOcean droplets immediately begin scanning the internal and external IP space to infect others [cite: 13].

### 2.3 Residential & IoT Botnets
Traffic from ISPs like **Korea Telecom (AS4766)**, **Viettel (AS7552)**, and **Chinanet (AS4134)** indicates compromised edge devices.
*   **Devices:** Home routers (MikroTik, Ubiquiti), IP cameras, and DVRs.
*   **Signatures:** These IPs frequently use the `345gs5662d34` credential set, which is specific to Polycom devices but now widely used by generic IoT botnets like Mirai to identify vulnerable embedded systems [cite: 7, 19].
*   **MikroTik Specifics:** We observed the command `/ip cloud print` originating from some of these IPs. This is a MikroTik RouterOS command used to check the device's DDNS settings, confirming that the attackers are scripting specific reconnaissance for MikroTik routers [cite: 16, 20].

---

## 3. Malware Analysis

Analysis of the file hashes (implied by command context) and behavioral signatures reveals three distinct malware families operating within the dataset.

### 3.1 Outlaw / Shellbot (The "mdrfckr" Campaign)
**Family:** Outlaw (Perl/Shellbot variant)
**Primary Indicator:** `cd ~; chattr -ia .ssh; lockr -ia .ssh`

This is the most prevalent threat actor in the dataset. The specific command chain observed is a hallmark of the **Outlaw** botnet.

*   **Behavioral Analysis:**
    1.  **Preparation:** The bot executes `cd ~ && rm -rf .ssh && mkdir .ssh` to wipe existing keys.
    2.  **Persistence (The "mdrfckr" Key):** It echoes a new RSA key into `authorized_keys`. The key comment is almost always "mdrfckr" [cite: 14, 21].
    3.  **Locking the Door:** It uses `chattr -ia .ssh` (to remove immutable flags if present) and then attempts to run `lockr -ia .ssh`. "lockr" is likely a shell function or script downloaded by the bot to manage file attributes, attempting to make the `.ssh` folder immutable (`chattr +i`) to prevent the legitimate owner from removing the attacker's key [cite: 21, 22, 23].
    4.  **Payload:** Outlaw typically installs a Monero miner (XMRig) and a Perl-based IRC bot for C2 communication. It targets Linux servers and IoT devices [cite: 1, 2].

### 3.2 GhostSocks / LummaC2 (The Proxy Network)
**Family:** GhostSocks / LummaC2
**Primary Indicator:** `locate D877F783D5D3EF8Cs`

This highly specific command is a critical finding. It signifies an attempt to locate **Telegram Desktop** session data.

*   **The Artifact:** `D877F783D5D3EF8Cs` is a specific filename or directory marker found within the Telegram Desktop `tdata` storage structure [cite: 15, 24, 25].
*   **Attribution:** Searching for this specific string is a technique mapped to the **LummaC2** infostealer and the **GhostSocks** malware family [cite: 3, 26].
*   **Operational Context:** GhostSocks is a "Malware-as-a-Service" that converts compromised machines into SOCKS5 proxies. It is often dropped by LummaC2. The attackers scan for the Telegram session to steal it, while simultaneously setting up the machine as a residential proxy node to resell access [cite: 4, 5]. The fact that this is running via SSH suggests the attackers are using compromised servers to scan *for* these files, or are checking if the server itself (perhaps a developer's VDI or jump box) has Telegram installed.

### 3.3 Mirai & IoT Variants
**Family:** Mirai / Gafgyt
**Primary Indicator:** `345gs5662d34` (Credential), `/ip cloud print` (Command)

*   **Credentials:** The use of `345gs5662d34` (default for Polycom CX600) as both username and password is a behavior hardcoded into many Mirai and Gafgyt variants [cite: 13, 19].
*   **Targeting:** These bots indiscriminately scan the internet. The presence of `/ip cloud print` commands indicates a module specifically aware of **MikroTik RouterOS** syntax, attempting to leverage MikroTik's cloud DNS feature or check for internet connectivity/public IP status [cite: 16, 20].

### 3.4 The "Monaco" Artifact
**Indicator:** `./monaco`
**Assessment:** Suspicious Binary / Miner

The command `./monaco` was observed. While no specific famous malware family is named "Monaco," in the context of honeypot logs, attackers often rename standard mining binaries (like XMRig) to generic names or names resembling system processes to evade simple detection. "Monaco" could be a reference to a specific mining pool, a project name, or a renamed binary of the **Kobalos** or **Perfctl** families, which are known to target high-performance computing and Linux servers [cite: 27, 28]. However, without the binary itself, it is classified as a probable cryptominer or backdoor payload.

---

## 4. Campaign Attribution

Based on the clustered indicators, we identify four distinct campaigns active against NadSec infrastructure.

### Campaign A: The "Outlaw" Persistence Campaign
*   **Goal:** Long-term persistence and cryptocurrency mining (Monero).
*   **TTPs:** Uses `chattr` to lock SSH keys; adds "mdrfckr" key; kills competing miners.
*   **Attribution:** The **Outlaw Group** (aka Shellbot). A financially motivated threat actor targeting Linux/IoT.
*   **Infrastructure:** Heavily utilizes compromised DigitalOcean droplets and Unmanaged Ltd servers to scan.

### Campaign B: The "n8n" Targeting Campaign
*   **Goal:** Compromise of workflow automation servers.
*   **TTPs:** Brute-forcing the username `n8n`.
*   **Context:** A trend emerging in Feb 2026. Attackers are likely targeting self-hosted `n8n` instances that may have been deployed with insecure SSH configurations or default container credentials. Compromising an `n8n` instance often yields API keys for other services (Stripe, AWS, Google), making it a high-value target [cite: 6, 29].

### Campaign C: The Proxy/Infostealer Nexus
*   **Goal:** Data theft (Telegram sessions) and infrastructure monetization (Proxy nodes).
*   **TTPs:** Searching for `D877F783D5D3EF8Cs`.
*   **Attribution:** Operators of **LummaC2** and **GhostSocks**.
*   **Significance:** The connection to **Servers Tech FZCO** (a known host for GhostSocks) strengthens this attribution. This campaign represents a shift from pure server abuse to data theft and residential IP monetization [cite: 5].

### Campaign D: The IoT Sweepers
*   **Goal:** Botnet recruitment (DDoS).
*   **TTPs:** Polycom credentials (`345gs5662d34`), MikroTik commands (`/ip cloud print`).
*   **Attribution:** **Mirai** and **Gafgyt** botnet herders.
*   **Infrastructure:** Predominantly originates from residential ISPs (Korea Telecom, Viettel) and compromised routers.

---

## 5. MITRE ATT&CK Mapping

| T-Code | Technique | Observed Evidence |
| :--- | :--- | :--- |
| **T1110.001** | Brute Force: Password Guessing | High volume of login attempts using `root`, `admin`, `n8n`. |
| **T1059.004** | Command and Scripting Interpreter: Unix Shell | Execution of bash commands (`cd ~`, `rm -rf`, `wget`). |
| **T1098.004** | Account Manipulation: SSH Authorized Keys | Overwriting `authorized_keys` with the "mdrfckr" key. |
| **T1222.002** | File and Directory Permissions Modification | Using `chattr -ia` and `chmod` to lock/unlock files. |
| **T1005** | Data from Local System | Searching for Telegram session files (`locate D877F783D5D3EF8Cs`). |
| **T1496** | Resource Hijacking | Deployment of XMRig miners (implied by Outlaw attribution). |
| **T1090** | Proxy | Connection to GhostSocks infrastructure (implied by Telegram targeting). |
| **T1071.001** | Application Layer Protocol: Web Protocols | Downloading payloads via `wget`/`curl` from C2s. |

---

## 6. Detection & Mitigation

### 6.1 Firewall & Network Security
*   **Block High-Risk ASNs:** Implement blocks for traffic originating from **AS202412 (Omegatech)**, **AS216071 (Servers Tech FZCO)**, and **AS47890 (Unmanaged Ltd)** if no legitimate business need exists.
*   **Geo-Blocking:** If business is local, restrict SSH (Port 22) access to Australia-only IPs, or whitelist specific management IPs.
*   **Rate Limiting:** Implement strict rate limiting on SSH connections (e.g., max 3 attempts per minute) to thwart brute-force attempts.

### 6.2 SIEM & Log Detection
*   **Detect Outlaw/Shellbot:**
    *   *Query:* `command_line contains "chattr -ia .ssh" OR command_line contains "lockr -ia"`
    *   *Query:* `file_content contains "mdrfckr"` (in authorized_keys monitoring)
*   **Detect Infostealer Scanning:**
    *   *Query:* `command_line contains "D877F783D5D3EF8Cs" OR command_line contains "TelegramDesktop"`
*   **Detect n8n Targeting:**
    *   *Query:* `ssh_username == "n8n"` (Spike in failed logins for this user).

### 6.3 Snort/Suricata Signatures

**Rule 1: Detect Outlaw "lockr" Command**
```snort
alert tcp $EXTERNAL_NET any -> $HOME_NET 22 (msg:"ET EXPLOIT SSH Shellbot/Outlaw Command (lockr -ia)"; flow:to_server,established; content:"lockr -ia .ssh"; fast_pattern; classtype:trojan-activity; sid:1000001; rev:1;)
```

**Rule 2: Detect Telegram Session Scan**
```snort
alert tcp $EXTERNAL_NET any -> $HOME_NET 22 (msg:"ET TROJAN Suspicious Telegram Session Scan (D877F783D5D3EF8Cs)"; flow:to_server,established; content:"D877F783D5D3EF8Cs"; fast_pattern; classtype:trojan-activity; sid:1000002; rev:1;)
```

---

## 7. IOC Appendix

### Top Attacking IPs (Sample)
*   **45.221.74.234 (UG):** SSH Brute Force.
*   **123.31.20.81 (VN):** VNPT Corp. High volume scanner.
*   **103.160.212.122 (ID):** PT Dewa Bisnis. 262 events.
*   **116.99.174.91 (VN):** Viettel. 302 events.
*   **170.64.195.40 (AU):** DigitalOcean. 1,439 events (Local geolocation, high volume).
*   **165.245.141.31 (US):** DigitalOcean. **5,096 events** (Highest volume in sample).

### High-Confidence Malware Indicators
*   **File/Path Marker:** `D877F783D5D3EF8Cs` (Telegram Session).
*   **SSH Key Comment:** `mdrfckr`.
*   **Username:** `n8n`.
*   **Credentials:** `345gs5662d34` / `345gs5662d34`.
*   **Commands:**
    *   `cd ~; chattr -ia .ssh; lockr -ia .ssh`
    *   `/ip cloud print`
    *   `./monaco`

---

## 8. Sources & Citations
[cite: 11] IPXO Organization Report (Omegatech LTD) [cite: 11]
[cite: 30] PhishStats (Omegatech abuse) [cite: 30]
[cite: 12] RiskRecon Threat Report (345gs5662d34 analysis) [cite: 13]
[cite: 31] Ellio Technology (n8n brute force trends) [cite: 6]
[cite: 17] CyderInc (lockr/mdrfckr analysis) [cite: 14]
[cite: 13] TEHTRIS Honeypot Report (lockr/mdrfckr) [cite: 22]
[cite: 32] SANS ISC Diary (Telegram D877F783D5D3EF8Cs analysis) [cite: 15]
[cite: 33] CloudSEK (APT35/Infostealer Telegram targeting) [cite: 26]
[cite: 34] Bloo.io (GhostSocks/Servers Tech FZCO link) [cite: 5]
[cite: 35] Elastic Security Labs (Outlaw Malware Analysis) [cite: 2]
[cite: 6] AbuseIPDB (Unmanaged Ltd reputation) [cite: 10]
[cite: 29] Reddit/Blogs (MikroTik /ip cloud print exploitation) [cite: 16, 20]

**Sources:**
1. [securelist.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFzhKqOGD2FMrO46aI5SrdClAoY7tzYFvVpjYsQ9mTSl24x2XlvANBgtxQOzE0PUwCCkyjl4-Hax7S2KKet-yf1HBUXrEk9bGxTU8s1nEyalLqT2oUpTvFKslrYEn2XsqM2Tg==)
2. [elastic.co](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQF3Wjqn2oK4I25jv9qyjAQJZjzjcr13V5GjFVX03Ox35vq3Jze6cczzIQTdKV0zKsoFFSx9HQYAJS-nYBQJSO8Ew2ALgYiSDp84opIHTvUhVO4hWb347-4noF0By_zFUx4JFqR-JzFytLq7sVG__W0=)
3. [uzcert.uz](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQE9Pz0tspq-YwPw1dupVSHHS2Owaohn5-TktNFwOVqTUDXZucYjINQXDlpbflwjkYDbVoL9qvPF2oJbw3A-1tjo1pH64cxd3P4_EE_i7waqLydLI3OAgBnSt_LvValwqCO_er0A6-CqXb7Cg0gAabJPt3aGAQKFcvu5-YxcoTtRsXkACkctqzkMY91ukeaD2RY=)
4. [spycloud.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHQxNM5p9cNFpjKY8p06wTzknWPD9lgyaOEnNIIpNTpZOcZJib34th1xWo8LJfDhcKKPTalgJOYvdVR5vKRPTrdBGS9KpXY4dP-q3zPNJUk7wrTY86-QYfk6v2PKNbJ4KXk4hAx5a5bCXaqQA==)
5. [bloo.io](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFhGyzvlHfOYCRxs5SFSSci-5NqNc_UYGxFQWQ_4A2KUQNo5WOthLrlffgXyT6W04t_eeitI-x71nVD4wsr0SIwZAONoV1nI20I0hPXkaZxvKSSH_zYwh5kRSZse8Hdv1oh)
6. [ellio.tech](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQE9aBErcultntJYFQfRi2JBDuH4umzM4XtSUo6ktdRuZfg0TDQk5oQ_X8GbIuS_-9w-4Zaj_JXTMozKxKEG93tnlOtWGnoYylC9bvHYOMSESR_VcXVoDHe6IQPSMY0Cb3qUPDPWGK0C9i2H9w==)
7. [sans.edu](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHQX8ZtyTIgEXYcLkCgChto_ZxtM6mqkAykCsuC3JVzmt8OS3qbja38fJxwlP1Pch7ge01sAmdZoDcXej0B0hTJr9KIzdO3TfcpPw7NuZXeXtpd7mx6pg==)
8. [medium.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQH8zkfmwVma6KvHuQ0p1ngHITcwS1W_BSXRKirnhkbDXNAYtyPq_mqwiukYADLiYkGAYdzlIrfqxItJPHN9RBLg39xSxXelXqmDOsyKmV804zwWhd60MZXMXzG06C0y0SWLJlrMwjZM2frmtltkaCuwFm6oVjyUZUUVlTH9wc0K8olvEyRV5Kd7OffF44gB4ZCNr_LK83QTNiSjvfhTeI095erj)
9. [abuseipdb.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEQLhHW_JaMRZPJMA17AT2e8i50AYwedZLT0pmtila2iWqh5KQKQAK0hnNYEBO8dCPsmH4jGAj8nvgQkq5VSnHBqCe0_0uxF5F1uCU65gWXQFVYoolpaK7SeIKeNXu3y1ww6Uk=)
10. [abuseipdb.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEnFE4SW9I7kv2rNqfPsu3ZuCoO5s83AxKn86d7rMgKigAkXV8GsndzpL74t7BT_9cPwUR1JKwanLRSmpfgD4z3c1gsi7All3_qk9tFWBRJZ2BL7rjSlhOIIWFHg3tsZh9Szw==)
11. [ipxo.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFlnMyUILdMzocY0P1tTyC9pg5Xx6q1FMpc7oskd62iTJMON6zwzl0cPJFqlf5p32-ysSKMN2ptnkiHY9GHA4-PrTU0lvcrRY5UfWBSqRUx18159yj49Rw-blrEsosVTUvLv3-qvdtPWw==)
12. [ipinfo.io](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQED_zMccZabH7rtFIlqn26PL7EJjXn-xuqbRNfrQJeu3eXvJtzXkISgv8xG5BERxpB1IIXCYck-WGjlFtFZRwwoffu6vDfFl52j3teIEk9l3ZyKvoRj)
13. [riskrecon.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQF_b2OzcUHNPh-pROBmrQzbX0uWRrY7LLmQ17K7ihHok0BIbWieVtuoiHJ3N1Z5SYr0NmvxN8bhiSn0qonMHU04gJ4TjN741Gf45jjnGFWEtk9CBCLO0ro0JSPfzxh2b5W4_qy94qrXhit-eS6Li43qcS6OTsr-)
14. [cyderinc.net](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHGI53Kk0ZyxBWc5F-2sx6_98EcZL30s-4PULvN000N36JLGYhHgrBDek-56ogY5lg-C8HE1NOhiMcIGgzJnpejsa9Ftj_GM510MYP6GY83qblaZJ3AZfM1_Kg-vBw09bmz6ckUJUH7FjAK_mGIrNn1ACt0e8tr_w8TJiAWZ8-VFIareJBRQFDAwb02WNotZA==)
15. [sans.edu](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQH0AEr03cK59yATxJUuf8EBHjdqHYmeoDe4rUAneHMi5NnNveB5Ih0Evqg2hfGRdaor7-fA6aqZS-o3TaYfMaQ8MdAkpsQoU_GNhThpHEu_C1OxKMW7mA==)
16. [reddit.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHxjorpdo-ccnM4S6VLRn3DN8ZJMkXR5QxB5U921DL4I6Th7tyyBZoLa9pamrPjSmcZEJrdNAV1r8Azruw4qVLNrBjhmEK4F9-9gWwxHapjqA9kRQnfDMci8J6ZoHUPV1W512-rrANSmAf3OLndeAW3VEG54iVruiDtY3X88GCQbVXwDQCoTcL0IK6NUNCKXA6VpYa-Cg==)
17. [jsdelivr.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFrR5DlsV_wu-NT40O6xR2LvqxGkdtCuUSAr6wVFlSflekB1jrUxlMeTGHhscIiOjsGY-i9t7zxtx7vam1XJhEZfwvsTPeiYtTFkqNKnbHiA07m-j7pmP27pEGi-AeL4CobiHAbnzuLlhM=)
18. [abuseipdb.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEja_G4zoVXlQQPKXFHHnaArLwzgNnbyhWh8POul-v4TOL7ATnbZ19HbnDozl8lh-vjdtciHUWsdAGSLPgu6W-vU8D3UU-6kh6UYiuAV3Ro_u7DLxdrPoz2g6WcvJdET1k1)
19. [dtu.dk](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGwTtUVA_VmLUp8fuQI14qkCWbvzMJ1bdt9N_pBnzRr7JILht7s52450Klkjh25vniBimycWNP3iFmnHcKgP5tE6fPNTB-aG_lnAUcoVqtY7OJhHv_UACPD7ndjc87Ej1w_sXOb_JRkgOUkEwM5OGYSxcolWuUzlFShU3_50RUWfHTrXkI=)
20. [sofiane.cc](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGlaYIewm7fPyAjHjsN3bRghlNCHVfvdC_kRZx1uhsAyrUB2ISGUfiYGW8nX5M2t5_vvaUppZXwTJcBA9BHaH-xh4vU3zpHZk1ohn1VBFU3Hqb9IkEkQstOEeSzQaQR-QZsePaCXNDHShWPrhlOwj7KG4f8dKhNbO72eDZ_UQorjZ-oDvH8XWcarg==)
21. [dennissalzner.de](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEWXl4wi78lrd8tPb_FxxqB4fOnYrYrZr0eBdUTw4LQOF_fJdDe1eLWj-CgBuiJq0cAjoOg2n4rVhsNlzO0rOswDiXsN558dG4aAJhDZlXvA8b0L6f3JcHsP4p4yBRwPSZF7QHW8UlO83GifMOo4j7-R0Tigx0hPQuGep6TzpzG9AtZX_ldGw==)
22. [tehtris.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHhlNMYKb309FcjwCFGkAwWyJtUF_NQ0vHgJymVpH_tYW7v7dbJXTCA2OHFUgPWq_g_GIUAjOLk8wy9dLN-CflEbnNyhDLHUjRbCWKPrkInHKmfYTqJxkNF072w8g-NtsT6TKOmk5eqt5b26jez7PvF_etEoF4Dxmf9Gx-GQI5Ugh5BJapTWdnAqA==)
23. [sans.edu](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEQDWzwtveQ1EvtJQz1Rp5v1R870uycz042HBD74aBrIejgcXYzb0nu-szRyo1gpyjkuDgNGh3Zima9aemhl-B99Zi2LFhAubhUkliXF5CMeB7BXePj4g==)
24. [xda-developers.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHoPGSdKsr2oUClofoEkUCIGPVqhBXNMHQKXahqNngPSmXxPGpwmrdA7JGxTu79-Wco8XefY1_OnjplNdtZxTW7u9xks_Z3udQwkVhZmVrGsBoHlTf-VaA_vA_kij4jKHfx5mLH7JOKDaxlZCUnNWzDeQsLAH2qKYw=)
25. [trendmicro.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEy8TmX5L_fQwuCD7qr6Hcby1eChDfB86WwHktFlvB4A6EcwvuLqNKiOQrtnfFu5GPg4MBk8hUBBGtJgq4urNYynZya8mWHm1kzuI2fN8fpanENLxpyTYAC-0HWRefMkD3f-NWkGqTyzkULV34vg_M9cOM1EgLPwLW5eXiDL8BZCD7IdBUI2SS63NCI8B4=)
26. [cloudsek.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQG-4mz6pyGBO0XSEG2_Aj-PLeeu1g_twpBUKCA2dE1qjNrM2gW-8cuVBj_chlUc-QZpGU-KpFeewy9ZvUYzu-6F_syFS28EutbIJJydi-DBf62slFy_hg4gYDK9LB8GN9Rt9lZIXvkRS-awotYOGjAtxVjWce3C3ddeVq4OlNpb8DfnlzO3i1XFEXZjSRUpQesgXyqPgkiQF4r7FQ6iWkXAcYLy)
27. [scworld.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGu2VDae_gqKfFsCIoQ5DYfbzAFVK__tzvemd7J99ECxh7owJEHG01xLMjGHc-LLrds3IJyrmXnl7LPk8FCHlPjDHMATMFIMZYsEWESAWJWE_AjjFxz-sFLY8SEL0zZ0gK0zjVulZhwz-vq_unXRxwpzcJI4Z4TX-Fvqrj6Nh2Y3CI_SpB8lMTKSwo3JDDfGYjP0o6TcmFLGsmCA18YZ57WEp4MOQ==)
28. [darkreading.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHRyuEIhZL057GWfGLqYJw6yU33-wsh7cZizScWpgjCtH50tJQWM5hYqX2XQv3vYjRsN99clew9etyhjlMt4vlaxkGGJYongqTDD7xXbhKGYrSlId_E1RjHQSSU8WjZaxoJ3Sn8KCQJ-SKAKDnzyx63-QGytb2Qqw1fkEUL3KDrhGBYmj4hPnxacwpPNKUMoqlzBOYXUM1a1KSxSsf4)
29. [massivegrid.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFQQ70BC6zSqApFpF9-M6aLcTxtiZ0Q8oXdVqMsGPbxH1-wxkd2KuAlX-BGnSMMBL3gQpdEP5BHFgZyZfffbttKk5CDIlc7iSbxrm_q7pVfiD0Wg6yoxXg0zfihQbbCVBdvS7TQdSsI_n8oyUohrdBbshxZxzqUoI4=)
30. [phishstats.info](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGdy28mQbYIRwCQ0kIt5_kmn9NLhEU7RUtNbkkRt4lkAoh7MxVQ3SpvFw47aM08223S3h_97tQyKuHFcbEDOH5hBSpe6l0yA5DT7wBms-WN0-sG7wwUMxsWyyOZ8SktrDjyfb0r5gUp65JXceE9dbx9UlorPvobflqRBx4y2uoSod7fFVEL4eNotKQnuMIT5u6TMmszxQ==)
31. [ipinfo.io](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFCgSfz6Yr3fr4Bb1OfU15Jo3LV_Ad0fzaLdes9KZurXzOgQgEzkAVmsrCob9e8l9grl268-MIQf7SVEyy3pcARNqD_dM4Zhb9KTN3kAbU_fSH8OSh6)
32. [jonsdocs.org.uk](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQH8URxbRJhNXO18fazEyicoKEF01o6LI0G0m-9rvOz6Lnja96HqcG5Byws1CWk1ystVjKahSEZ0PRVRnCvk2Hh0gwQheSJl5X0um_Rwbj-8S1UWBGPgyOzZGRWjrehZa15X28CSLwLplOTBUSuJRpBvGQIUSF-7Ij_xXwUW3g==)
33. [github.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFKZ55KMIkoBoAyvLKMMg3K93DqdlAEvSsFKT4fhIK20rUy2f7gv9tSvnI4jPqUfQHIJntskbycr05Z9N-H2SxCQQES7qVMsywwHuVe3Pq8rpX4c91hEbDxKLqYmyPc7IKpkbyOJm7gZy4xHnkwGiE0MzhIjeA0)
34. [bankinfosecurity.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFBi5qDhMCpiU6cZw-h_yxxSxrE0KAKpG4NQjvGbU9y-X10h2nKqeB6GJQu7kTrHhDM9ukx_73Px0HR_Ep833S6Fy1harTjuFTHWoQNHts4yjFI5l0zEZ-28jWcNpExbYiLumtYwOHtmBmLoNRqHicYB9B4iyWq6im6KPq9IBntXHNLxZqqoyblf18cEo1qXUt80LN8EAZO5Q==)
35. [infosecwriteups.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFGn7qfczrm8gydN3BPm1sgYz7Ha6zOmI9WbSHiHH2lpPer_6zkH1_o6y7Z2rrXj80rzzWgP8s9DC_GbdlOCH3UESQlgbKpIDIst8mRze5MkSOA96OcOWHmuOFu3zu7NnJ1vMXX1TbQbMg4NWDtRm6lL5COBopszhy_JApOWHhC_7osIpUu0mWjBmqX9Hpj29VFQIBD1tc=)