SSH & Telnet traps catching credential stuffing.

# SSH & Telnet Brute Force Intelligence - NadSec April 2026

**Key Points:**
*   **Massive Brute-Force Volume:** The April 2026 dataset from the NadSec Sydney T-Pot infrastructure recorded 684,766 attacks across 129,976 sessions from 4,037 unique IPs, highlighting a sustained and aggressive brute-force landscape.
*   **Outlaw Botnet Dominance:** Evidence strongly suggests the pervasive presence of the Outlaw (Dota) botnet, characterized by the insertion of the `mdrfckr` SSH key, manipulation of immutable file attributes using `chattr` and `lockr`, and the termination of competing processes like `/tmp/secure.sh`.
*   **Targeted Telegram Exfiltration:** The presence of commands seeking the `D877F783D5D3EF8Cs` file indicates targeted efforts by infostealers (potentially MINER Stealer or APT35 variants) to quietly exfiltrate Telegram Desktop session tokens and bypass two-factor authentication.
*   **Anomalous IoT Credentials:** A significant portion of authentication attempts utilized the string `345gs5662d34` (and its variants) as both a username and password. Research indicates this is a default credential for Polycom CX600 IP phones, heavily targeted by IoT botnets experiencing parsing errors.
*   **Advanced Honeypot Evasion:** Threat actors are increasingly employing evasion techniques, such as reading ELF binary headers via `dd bs=52 count=1 if=.s`, to distinguish high-interaction targets from emulated honeypot environments like Cowrie.
*   **Infrastructure Abuse:** Brazilian residential/ISP networks (notably W-NET TELLECOM) and European bulletproof/cloud hosting providers (e.g., Pfcloud UG, Contabo) serve as the primary launching pads for these automated campaigns.

**Report Scope and Limitations:**
This report provides a comprehensive examination of SSH and Telnet brute-force patterns observed during April 2026. While the dataset encompasses a vast array of attacker IPs, usernames, passwords, and commands, it is important to note that the provided STIX 2.1 bundle did not contain specific file hashes or standalone URL indicators. Consequently, malware attribution relies exclusively on behavioral analysis, command signatures, and tactical overlaps with known threat actors.

***

## 1. Introduction and Theoretical Framework

In the contemporary cybersecurity paradigm, remote administration protocols such as Secure Shell (SSH) and Telnet represent dual-edged swords. While indispensable for legitimate system management, their ubiquity renders them perennial targets for automated exploitation. The data collected by the NadSec honeypot infrastructure in Sydney throughout April 2026 serves as a critical microcosm of global threat activity. Utilizing a combination of Cowrie (a medium-to-high interaction SSH/Telnet honeypot) and Heralding (a credentials-catching sensor), the NadSec deployment captured the initial access, execution, and persistence methodologies of thousands of malicious actors [cite: 1, 2].

The conceptual foundation of this report relies on the premise that modern brute-force attacks are rarely isolated incidents executed by manual operators. Instead, they are the mechanized output of vast, distributed botnets functioning as initial access brokers or automated resource hijackers [cite: 3, 4]. These botnets continuously scan the IPv4 and IPv6 address spaces, seeking weak credentials to subjugate host hardware for purposes ranging from distributed denial-of-service (DDoS) amplification and proxy routing to cryptocurrency mining and sensitive data exfiltration [cite: 5, 6]. 

A rigorous analysis of the April 2026 data reveals the ongoing arms race between defenders utilizing deception technology (honeypots) and attackers deploying sophisticated evasion mechanisms [cite: 7, 8]. By decoding the aggregate statistics and behavioral artifacts left within the Cowrie logs, this report dissects the infrastructure, malware families, and campaign methodologies driving current brute-force phenomena.

## 2. Statistical Overview and Aggregate Data Analysis

The aggregate statistics derived from the unsampled dataset of 4,126 original indicators provide a macroscopic view of the threat landscape. During April 2026, the honeypot network processed 684,766 individual attack events originating from 4,037 unique IP addresses. 

### 2.1 Geographical and Network Attribution

The geographical distribution of attacking IP addresses is highly skewed toward a mixture of rapidly developing technological economies and established western cloud infrastructure hubs. 

**Table 1: Top 10 Source Countries**

| Rank | Country | Event Count | Primary Attack Typology |
| :--- | :--- | :--- | :--- |
| 1 | Brazil (BR) | 89,485 | Residential Botnets / Compromised IoT |
| 2 | United States (US) | 71,068 | Cloud Computing Abuse / Proxies |
| 3 | Netherlands (NL) | 51,821 | Bulletproof Hosting / Scanners |
| 4 | Hong Kong (HK) | 36,625 | Cloud Abuse / VPS hosting |
| 5 | Indonesia (ID) | 36,440 | Compromised Residential Networks |
| 6 | Vietnam (VN) | 34,602 | Compromised Routers / IoT |
| 7 | Germany (DE) | 28,023 | Cloud Computing Abuse |
| 8 | India (IN) | 24,421 | Compromised Infrastructure |
| 9 | Mexico (MX) | 23,494 | Residential Botnets |
| 10 | South Korea (KR) | 23,221 | Compromised Servers / IoT |

The prominence of Brazil as the leading source of attack traffic correlates directly with the highest-ranked Autonomous System Number (ASN) in the dataset: **W-NET TELLECOM EIRELI ME (AS267062)**, which accounted for 76,160 events. W-NET Tellecom is a fixed-line ISP in Brazil, known historically for hosting extensive ranges of dynamic consumer IP addresses [cite: 9, 10]. The vast volume of malicious traffic originating from AS267062 strongly suggests a massive, localized botnet infection targeting consumer-grade routers and IoT devices within that ISP's network [cite: 11, 12].

Conversely, traffic from the United States, Netherlands, and Germany predominantly stems from abused cloud providers. ASNs such as Microsoft Corporation (34,009 events), Unmanaged Ltd (31,763 events), and Pfcloud UG (26,887 events) illustrate the persistent challenge of attacker registration on inexpensive or easily compromised Virtual Private Server (VPS) infrastructure [cite: 13, 14].

### 2.2 The `345gs5662d34` Credential Anomaly

A mathematical analysis of credential brute-forcing typically reveals distributions heavily weighted toward default administrative accounts (e.g., `root`, `admin`) and simplistic passwords (e.g., `123456`, `password`). While `root` remains the apex targeted username (1,516 instances), the second most frequent username was the highly anomalous string `345gs5662d34` (967 instances). Strikingly, the top two passwords recorded were `3245gs5662d34` and `345gs5662d34`, respectively [cite: 15, 16].

This statistical quirk requires specialized threat intelligence contextualization. Research indicates that the string `345gs5662d34` is a hardcoded, default password associated with specific embedded devices, most notably **Polycom CX600 IP phones** [cite: 4, 17]. The prevalence of this string appearing in the *username* field is an artifact of poorly configured IoT botnet scripts [cite: 17, 18]. Bot herders, attempting to iterate rapidly through default credential pairs, often utilize misaligned parsing logic in their scanning modules, resulting in the password being erroneously transmitted during the username handshake phase [cite: 17, 19].

The variant `3245gs5662d34` (with an added '2') demonstrates minor mutations in the botnet's dictionary files, likely resulting from manual transcription errors by malware authors building credential stuffing lists [cite: 16, 20]. The sheer volume of these attempts—accounting for roughly 30% of SSH brute-force activity in some global sensors—highlights a dedicated, widespread campaign actively hunting for legacy Unified Communications (UC) hardware to subsume into IoT botnets like Mirai or Gafgyt [cite: 15].

## 3. Campaign Analysis and Behavioral Malware Attribution

While explicit malware hashes were not captured during this specific collection window, the sequences of shell commands executed by attackers post-authentication serve as highly reliable behavioral fingerprints. These commands reveal the presence of at least three distinct, sophisticated campaigns operating against the NadSec honeypots.

### 3.1 Campaign 1: The Outlaw (Dota) Cryptomining Botnet

The most elaborate and destructive command sequences logged by the Cowrie sensors are unambiguous signatures of the **Outlaw** (also known as **Dota**) hacking group [cite: 21, 22]. Outlaw has historically targeted Linux environments to deploy Monero (XMR) cryptominers (specifically customized UPX-packed binaries like `kswapd0`) alongside Perl-based IRC botnet backdoors (often referred to as Shellbot) [cite: 5, 23].

The command logs from the dataset showcase the exact multi-stage execution and persistence mechanisms of the Outlaw botnet:

**Phase 1: Environment Preparation and Competitor Eradication**
```bash
rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
```
This sequence, executed 678 times, serves to neutralize competing malware and disable basic host protections [cite: 24, 25]. The scripts `/tmp/secure.sh` and `auth.sh` are frequently utilized by other botnets or administrators (potentially related to open-source hardening scripts like ChrisTitusTech's `secure.sh`) [cite: 24, 25]. By utilizing `pkill -9`, the malware forcefully terminates these processes. Emptying `/etc/hosts.deny` ensures that TCP wrapper restrictions do not block the attacker's subsequent Command and Control (C2) communications [cite: 24, 25].

**Phase 2: SSH Key Hijacking and Persistence**
```bash
cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3...mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
```
To maintain persistent access independently of the compromised password, Outlaw forcefully deletes the existing `.ssh` directory, rebuilds it, and injects a predefined RSA public key into `authorized_keys` [cite: 26, 27]. The distinct comment at the end of the attacker's RSA key is **`mdrfckr`**, a well-documented Indicator of Compromise (IoC) exclusively tied to Dota/Outlaw campaigns [cite: 6, 21, 22]. 

**Phase 3: Attribute Manipulation**
```bash
cd ~; chattr -ia .ssh; lockr -ia .ssh
```
Executed over 1,000 times, this command ensures the payload's survival [cite: 26, 28]. The `chattr -ia` command removes the immutable (`i`) and append-only (`a`) filesystem attributes from the `.ssh` directory, allowing the botnet to overwrite it [cite: 23, 25]. Because some system administrators or competing botnets utilize alternative utilities to lock files, the attacker also invokes `lockr -ia .ssh`. `lockr` functions identically to `chattr` in this context, demonstrating the attacker's thoroughness in bypassing persistence defenses [cite: 25, 27]. 

### 3.2 Campaign 2: Targeted Telegram Session Exfiltration

A second, highly distinct campaign is identifiable through the presence of highly specific reconnaissance commands aimed at the `/dev/shm` and local user directories, culminating in:

```bash
locate D877F783D5D3EF8Cs
ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata ...
```

This sequence is a surgical attempt to locate and exfiltrate authentication tokens associated with the Telegram Desktop messaging application [cite: 2, 29]. The string **`D877F783D5D3EF8Cs`** is not arbitrary; it represents a specific encrypted session blob (MTProto auth key) utilized by Telegram Desktop to maintain an active login state for a user's primary account [cite: 30, 31]. 

Telegram stores session data within the `tdata` directory. Because Telegram Desktop relies on local encryption keys rather than requiring repeated 2FA or password inputs upon every launch, an attacker who successfully copies the `tdata` directory (specifically the `D877F783D5D3EF8Cs` auth key and the `key_datas` local key) can perfectly clone the victim's session on their own hardware [cite: 30, 32]. This allows the attacker full access to the victim's messages, contacts, and channels without triggering security alerts [cite: 32].

This specific exfiltration behavior is strongly attributed to specialized info-stealing malware, notably **MINER Stealer** (operated by a threat actor known as "Shadow") [cite: 32] and the **Cloud Atlas (APT) VBCloud backdoor** [cite: 31]. Furthermore, Iranian state-sponsored actors, such as **Charming Kitten (APT35)**, heavily rely on the extraction of `D877F783D5D3EF8Cs` to monitor dissidents and targets of interest via Telegram [cite: 33]. The presence of this command within bulk automated brute-force traffic suggests that advanced infostealing logic is increasingly being integrated into commodity botnet payloads.

### 3.3 Campaign 3: Honeypot Evasion and Fingerprinting

A sophisticated subset of attacks focused heavily on verifying the authenticity of the host environment before deploying secondary payloads. The top commands list reveals:

```bash
dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s
/bin/busybox cat /proc/self/exe || cat /proc/self/exe
```

This is a classic honeypot evasion technique [cite: 7, 34]. Low-to-medium interaction honeypots like Cowrie emulate a UNIX filesystem using Python scripts. They do not possess actual Executable and Linkable Format (ELF) binaries for standard commands.

By executing the `dd` (disk dump) command to read the first 22 to 52 bytes of the current shell's executable (`/proc/self/exe` or `$SHELL`), the attacker is checking for the presence of the "ELF" magic header bytes (`\x7fELF`) [cite: 7, 8]. If the command fails, returns text, or results in a "Command not found" error (as seen frequently in Cowrie logs [cite: 35, 36]), the malicious script recognizes that it is trapped within a deception environment and immediately issues an `exit` or `rm .s` command to abort the infection cycle and preserve its advanced payloads [cite: 8, 34].

## 4. Infrastructure Deep Dive and IP Attribution

An analysis of the 800-IP sample highlights the diverse infrastructure utilized by threat actors. Attackers leverage a mix of compromised residential networks (for obfuscation and IP rotation) and bulletproof or abused cloud hosting (for high-bandwidth command and control).

### 4.1 Compromised Residential Networks and ISPs

**W-NET TELLECOM EIRELI ME (AS267062) - Brazil**
As established, AS267062 generated the highest volume of events. Sampled IPs such as `177.124.11.114` and `189.1.152.150` (Desktop Sigmanet) indicate widespread exploitation of Brazilian ISP space. The threat actors likely exploit vulnerabilities in consumer-grade GPON routers (e.g., V*SOL, Huawei) or leverage default Telnet credentials to amass a localized bot army [cite: 17]. The use of residential IPs enables attackers to bypass simple Geo-IP blocking and data-center IP blacklists [cite: 11, 12].

**PT Cloud Hosting Indonesia (AS136052) & Reliance Jio (AS55836) - Asia Pacific**
Numerous IPs from Indonesia (e.g., `103.49.239.217`, `27.112.78.170`) and India (e.g., `136.232.11.10`, `152.58.81.255`) were observed. These regions feature rapidly expanding internet access, often accompanied by a lag in basic security hygiene. Botnets aggressively target these ASNs to harvest bandwidth for DDoS amplification [cite: 16, 20].

### 4.2 Cloud Abuse and Bulletproof Hosting

**Pfcloud UG (haftungsbeschrankt) (AS51396) - Germany/Netherlands**
IPs belonging to Pfcloud UG, such as `176.65.132.156`, `45.156.87.99`, and `45.156.87.204`, show disproportionately high event counts (e.g., `45.156.87.204` logged 3,965 events alone). Threat intelligence databases show Pfcloud IPs carrying a 100% confidence of abuse, frequently reported for port scanning and SSH brute-forcing [cite: 37, 38]. While ostensibly a legitimate cloud provider [cite: 13, 39], its infrastructure is systematically favored by cybercriminals for launching high-velocity automated scans, acting as a "gray-zone" hosting provider where abuse reports are processed slowly or ignored [cite: 14, 38].

**DigitalOcean (AS14061) and OVH (AS16276) - Global**
The dataset contains dozens of IPs from major cloud providers (e.g., `45.55.32.64` and `167.99.1.98` for DigitalOcean; `51.79.84.112` and `5.39.70.2` for OVH). Attackers routinely utilize stolen credit cards or crypto-purchased virtual private servers on these networks. The high bandwidth allows them to run aggressive mass-scanners like `ZMap` and `Masscan` to locate open port 22/23 hosts before deploying targeted dictionary attacks [cite: 16, 40].

**Censys (AS398324) and Google (AS396982)**
Interestingly, IPs such as `66.132.195.90` (Censys) and `34.80.153.84` (Google) are present. While Google Cloud is heavily abused by attackers, Censys is a legitimate research organization that scans the internet for vulnerability mapping. The honeypot correctly captures Censys's automated handshake attempts, which must be filtered out of the malicious threat feed to avoid false positives during incident response [cite: 40, 41].

## 5. Infrastructure Mapping and Attack Chain

The observed behaviors can be mapped into a sequential attack chain, defining the lifecycle of the intrusions targeting the NadSec infrastructure.

**1. Reconnaissance and Scanning:**
Attackers leverage cloud VPS infrastructure (e.g., DigitalOcean, Pfcloud) to execute high-speed port scans across the IPv4 space, targeting TCP 22 (SSH) and TCP 23 (Telnet).

**2. Initial Access (Brute-Force):**
Upon identifying open ports, botnets (originating from infected residential nodes in ASNs like W-NET and Reliance Jio) launch dictionary attacks. They rely on dictionaries populated with classic defaults (`root`, `admin`) and IoT-specific flaws (`345gs5662d34` for Polycom, `7ujMko0admin` for Dahua) [cite: 4, 17].

**3. Execution and Environment Discovery:**
Upon successful authentication, the malware initiates shell commands. First, it fingerprints the environment (`uname -a`, `cat /proc/cpuinfo`) to determine the architecture (x86, ARM, MIPS) to ensure the correct payload is downloaded [cite: 28, 34]. It simultaneously runs evasion checks (`dd bs=52 count=1 if=.s`) to detect honeypots [cite: 7].

**4. Defense Evasion and Competitor Termination:**
The malware eliminates pre-existing threats to secure processing power. It kills known processes (`pkill -9 secure.sh`) and alters host firewalls (`echo > /etc/hosts.deny`) [cite: 24, 25].

**5. Persistence:**
Outlaw and related botnets ensure long-term access by injecting customized RSA public keys (commented `mdrfckr`) into the `~/.ssh/authorized_keys` file. They subsequently alter file attributes (`chattr -ia`, `lockr -ia`) to lock down the directory [cite: 26, 28, 42].

**6. Collection and Exfiltration:**
Infostealing variants pivot immediately to data harvesting, utilizing `locate` and `ls -la` to find sensitive directories. Targets include Telegram Desktop configurations (`tdata/D877F783D5D3EF8Cs`) and cryptocurrency wallets, which are then compressed and exfiltrated via curl or wget to attacker C2 servers [cite: 31, 32].

**7. Impact:**
For non-stealer variants, the final stage involves downloading and executing a UPX-packed payload (like XMRig `kswapd0`) to consume CPU cycles for Monero mining, or enlisting the node into a Mirai/Gafgyt network for DDoS-for-hire services [cite: 5, 21, 23].

## 6. MITRE ATT&CK Mapping

The behaviors observed in the April 2026 honeypot data map directly to the following tactics and techniques within the MITRE ATT&CK framework:

| Tactic | Technique ID | Technique Name | Observation / Context |
| :--- | :--- | :--- | :--- |
| **Reconnaissance** | T1595.001 | Active Scanning: Scanning IP Blocks | High-volume scanning originating from cloud providers (Pfcloud, OVH) seeking open ports 22 and 23. |
| **Initial Access** | T1110.001 | Brute Force: Password Guessing | Automated botnets utilizing credential dictionaries including IoT defaults like `345gs5662d34`. |
| **Initial Access** | T1078.003 | Valid Accounts: Local Accounts | Successful authentication into standard UNIX accounts such as `root`, `ubuntu`, and `admin`. |
| **Execution** | T1059.004 | Command and Scripting Interpreter: Unix Shell | Extensive use of `/bin/sh` and `/bin/busybox` to execute chained scripts upon login. |
| **Persistence** | T1098.004 | Account Manipulation: SSH Authorized Keys | The Outlaw botnet writing the `mdrfckr` public key to `~/.ssh/authorized_keys` [cite: 41, 43]. |
| **Defense Evasion** | T1222.002 | File and Directory Permissions Modification | Execution of `chmod -R go=`, `chattr -ia`, and `lockr -ia` to prevent security modifications to the `.ssh` folder [cite: 25, 27]. |
| **Defense Evasion** | T1562.001 | Impair Defenses: Disable or Modify Tools | The termination of competing security and mining scripts via `rm -rf /tmp/secure.sh` and `pkill -9` [cite: 24]. |
| **Defense Evasion** | T1562.004 | Impair Defenses: Disable or Modify System Firewall | Writing blank lines to `/etc/hosts.deny` to prevent the host from blocking malicious IP ranges. |
| **Defense Evasion** | T1497.001 | Virtualization/Sandbox Evasion: System Checks | Using `dd bs=52` to inspect ELF headers of the shell executable to detect Cowrie honeypots [cite: 7, 8]. |
| **Discovery** | T1082 | System Information Discovery | Polling `uname -a`, `cat /proc/cpuinfo`, and `free -m` to evaluate the system architecture and available resources for cryptomining. |
| **Discovery** | T1083 | File and Directory Discovery | Using `locate` and `ls -la` to find sensitive communication folders and backup files. |
| **Credential Access** | T1552.001 | Credentials in Files | Targeting the Telegram `tdata` directory and `D877F783D5D3EF8Cs` MTProto keys for account hijacking [cite: 29, 30]. |
| **Impact** | T1496 | Resource Hijacking | The primary objective of the Outlaw/Dota campaign: hijacking CPU cycles to execute `kswapd0` (XMRig) for Monero mining [cite: 5, 21]. |

## 7. Detection and Mitigation Strategies

Defending against the advanced automation observed in these campaigns requires a multi-layered approach involving network filtering, system hardening, and proactive behavioral monitoring.

### 7.1 System Hardening and Architectural Mitigations

1.  **Disable Password Authentication:** The most effective defense against T1110 Brute Force attacks is the complete deprecation of password-based SSH logins. Administrators must enforce Key-Based Authentication (RSA/Ed25519) across all external-facing endpoints.
2.  **Disable Remote Root Login:** Modify `/etc/ssh/sshd_config` to explicitly set `PermitRootLogin no`.
3.  **Harden Immutable Flags:** While attackers use `chattr` to protect their malicious keys, defenders can use it preemptively. Setting critical directories and files to immutable (`chattr +i /etc/hosts.deny` and `chattr +i ~/.ssh/authorized_keys`) establishes an administrative roadblock requiring root-level unlocking.
4.  **Network Segmentation for IoT:** Devices utilizing default passwords like Polycom IP phones (`345gs5662d34`) or Dahua cameras must be placed on isolated VLANs without direct ingress routing from the WAN.

### 7.2 SIEM and Behavioral Queries (Splunk SPL)

Security Operations Centers (SOC) can utilize the following Splunk logic to identify post-exploitation artifacts generated by the Outlaw botnet and Telegram Stealers:

**Query 1: Detecting Outlaw `.ssh` Manipulation and Key Insertion**
```splunk
index=linux_secure sourcetype=bash_history OR sourcetype=syslog
| search (command="*chattr -ia*" OR command="*lockr -ia*") AND command="*.ssh*"
| stats count by host, user, command
| eval threat="Potential Outlaw Botnet Persistence"
```

**Query 2: Detecting SSH Key Injection containing 'mdrfckr'**
```splunk
index=linux_secure sourcetype=authpriv
| search "mdrfckr" OR "AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4"
| stats count by src_ip, dest_host
| eval alert="Compromised SSH Key Identified"
```

**Query 3: Detecting Telegram `tdata` Exfiltration Commands**
```splunk
index=linux_auditd action=executed
| search command="*locate D877F783D5D3EF8Cs*" OR command="*ls -la*TelegramDesktop/tdata*"
| table _time, host, user, command
| eval threat="Telegram MTProto Session Theft Attempt"
```

### 7.3 Network Intrusion Detection Signatures (Snort/Suricata)

Deploy the following Suricata rules to alert on unencrypted network traffic attempting to download Outlaw botnet payloads or exfiltrate Telegram data:

**Rule 1: Outlaw Botnet Script Download (`tddwrt7s.sh` or `dota.tar.gz`)**
```suricata
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Outlaw Botnet Payload Download Attempt"; flow:established,to_client; content:"GET"; http_method; content:"/dota.tar.gz"; http_uri; fast_pattern; classtype:trojan-activity; sid:1000001; rev:1;)
```

**Rule 2: Outlaw IRC C2 Traffic**
```suricata
alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"ET MALWARE Outlaw IRC Botnet C2 Communication"; flow:established,to_server; content:"JOIN"; nocase; content:"#"; nocase; pcre:"/JOIN\s+#\w+/i"; classtype:command-and-control; sid:1000002; rev:1;)
```

**Rule 3: Telegram `tdata` Archive Exfiltration (ZIP headers containing specific patterns)**
```suricata
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT Telegram Session tdata Exfiltration"; flow:established,to_server; content:"D877F783D5D3EF8Cs"; nocase; classtype:successful-recon-leak; sid:1000003; rev:1;)
```

## 8. Conclusion

The comprehensive analysis of the NadSec honeypot data from April 2026 illuminates a stark reality: SSH and Telnet brute-force campaigns are no longer the exclusive domain of simplistic, noisy scanners. While the volume of brute-force traffic remains exceptionally high—dominated by networks in Brazil, the United States, and the Netherlands—the payloads delivered post-authentication have evolved significantly in sophistication.

Threat actors are seamlessly integrating traditional cryptomining infrastructure (the Outlaw/Dota botnet) with advanced infostealing capabilities (Telegram session hijacking via `D877F783D5D3EF8Cs`). The convergence of these methodologies allows attackers to monetize compromised endpoints simultaneously through resource theft and identity/data theft. Furthermore, the pervasive implementation of honeypot fingerprinting techniques (such as `dd` binary reading) demonstrates that cybercriminals are actively adapting to deception-based defense mechanisms.

To mitigate these threats, organizations must transition fully away from password-based remote administration protocols, implement robust egress filtering to block automated C2 and IRC traffic, and heavily monitor endpoint execution logs for anomalies corresponding to `.ssh` directory manipulation and unauthorized searches for application session tokens.

## 9. IOC Appendix

*Note: The original dataset provided 800 sampled IPs. A curated list of the most critical infrastructural and threat-actor associated ASNs/IPs is detailed below. Zero file hashes or explicit URLs were available in the STIX extract; therefore, malware detection must rely on the behavioral command signatures detailed in Section 7.*

### Significant IP Addresses and Infrastructure Context

| IP Address | Target Port(s) | ASN & Organization | Source Country | Threat Context / Classification |
| :--- | :--- | :--- | :--- | :--- |
| `176.65.132.156` | 22 (SSH) | AS51396 (Pfcloud UG) | DE (Germany) | **Bulletproof / Cloud Abuse.** 1,510 events. Known gray-zone hosting heavily abused for continuous automated SSH scanning and brute-forcing. |
| `45.156.87.204` | 22 (SSH) | AS51396 (Pfcloud UG) | NL (Netherlands) | **Bulletproof / Cloud Abuse.** 3,965 events. Highest-volume individual scanner in the sample dataset. |
| `189.1.152.150` | 23 (Telnet) | AS28668 (Desktop Sigmanet) | BR (Brazil) | **Residential Botnet.** Associated with the massive Brazilian IoT exploitation wave, aligning with W-NET TELLECOM activity. |
| `177.124.11.114` | 23 (Telnet) | AS262285 (VIVAS TELECOM) | BR (Brazil) | **Residential Botnet.** Compromised consumer router targeting Telnet configurations. |
| `14.103.178.182` | 22 (SSH) | AS4811 (China Telecom) | CN (China) | **Compromised Infrastructure.** 149 events targeting default credentials, typical of Mirai/Gafgyt expansion efforts. |
| `51.159.149.54` | 22 (SSH) | AS12876 (Scaleway SAS) | FR (France) | **Cloud Abuse.** 185 events. Utilization of European cloud infrastructure for high-bandwidth scanning. |
| `34.80.153.84` | 22 (SSH) | AS396982 (Google LLC) | TW (Taiwan) | **Cloud Abuse.** 87 events. Attackers utilizing compromised Google Cloud resources to deploy payloads. |
| `138.197.179.186` | 23 (Telnet) | AS14061 (DigitalOcean) | DE (Germany) | **Cloud Abuse / C2 Relay.** 41 events. DigitalOcean droplets are frequently leveraged as staging servers for secondary payload drops (`dota.tar.gz`). |
| `197.243.0.62` | 22 (SSH) | AS37228 (Olleh-Rwanda) | RW (Rwanda) | **Compromised Infrastructure.** 362 events. Demonstrates the global proliferation of botnet nodes leveraging credentials like `345gs5662d34`. |
| `66.132.195.90` | 23 (Telnet) | AS398324 (Censys, Inc.) | US (United States) | **Research Scanner.** Legitimate internet-wide scanning activity captured by the honeypot. |

### Associated Behavioral Indicators (Pseudo-Hashes)
While specific SHA256 hashes were unavailable, any artifact or file matching the execution of the following structures must be treated as critical IoCs:
*   **Filename:** `tddwrt7s.sh` (Outlaw Initial Stager)
*   **Filename:** `dota.tar.gz` (Outlaw Payload Archive)
*   **Filename:** `kswapd0` (UPX-packed XMRig instance)
*   **File Path:** `~/.ssh/authorized_keys` ending with the string `mdrfckr`
*   **Targeted File:** `tdata/D877F783D5D3EF8Cs` (Telegram MTProto Auth Key)

***
**References & Citations:**
*   [cite: 25, 26] Codyskinner & Port22 (2023-2024). Analysis of `mdrfckr` SSH keys and `lockr`/`chattr` command manipulation in Cowrie honeypots.
*   [cite: 24] Reddit Cybersecurity Forum (2025). Analysis of `rm -rf /tmp/secure.sh` scripts in SSH honeypots.
*   [cite: 2, 31] Kaspersky Securelist & XDA Developers (2024-2025). Exploitation and exfiltration of Telegram `D877F783D5D3EF8Cs` session keys by APT and commodity malware.
*   [cite: 32] CTI Monster (2026). Report on MINER Stealer and "Shadow" botnet operations targeting Telegram `tdata`.
*   [cite: 29, 30] GitHub TDesktop Session & SANS ISC (2025). Mechanisms of MTProto authentication and Telegram local key storage (`D877F783D5D3EF8Cs`).
*   [cite: 15, 17] SANS ISC & InfoSec Writeups (2024). Identification of `345gs5662d34` as default Polycom CX600 credentials.
*   [cite: 16, 20] RiskRecon & TEHTRIS (2022-2023). Statistical dominance of `3245gs5662d34` in global credential stuffing attacks.
*   [cite: 27, 28] SANS ISC & CyderInc (2023). Deep dive into Outlaw Hacker Group's use of `lockr -ia` and SSH configuration modifications.
*   [cite: 21, 23] Elastic Security Labs & GBHackers (2025). Technical analysis of the Outlaw/Dota Linux malware, XMRig deployment, and IRC C2 structures.
*   [cite: 9, 11] IPInfo & BGP Tools (2025). Autonomous System reporting for W-NET TELLECOM EIRELI ME (AS267062).
*   [cite: 5, 22] Kaspersky & Security Affairs (2020-2025). Extended tracking of the Outlaw botnet and Monero cryptomining operations.
*   [cite: 13, 37] PeeringDB & AbuseIPDB (2025-2026). Cloud abuse metrics and infrastructure analysis of Pfcloud UG (AS51396).
*   [cite: 7, 8] SANS ISC & IIJ (2017-2024). Attackers utilizing `dd bs=52` to fingerprint and evade Cowrie/emulated honeypot environments.
*   [cite: 6, 43] Dennis Salzner & Edie Blog (2023-2024). Incident response methodologies for tracking persistent `mdrfckr` SSH keys.
*   [cite: 31, 33] CloudSEK & Securelist (2024-2025). Iranian APT35 (Charming Kitten) and Cloud Atlas utilization of Telegram exfiltration modules.

**Sources:**
1. [jhu.edu](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHFbIyse60HyWjYySnVRo-0ZzM-NeuRkagogDYkMeXqZGk5V2RPMi9-X-VWa53U3gUQasoVKdDQiP-i5XzfI0y4Z5NPIv2NutPcs2pKEJKbREOP9OFJ5QpOlEfg-rT3QKO9OPlqvV542fMmBaXbZ5iewLMurQz7uDU_p75Hu7gBR32ACkcDHRlU)
2. [xda-developers.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGLgib4IxxAAeeaMN5wjiD8iz4br53arVoqQoTPVYkOEM5eH6FJORnh8vWAYi9CZkLdic7flgzFHMQ4l_SvwHsvDKhDE9B-7AniabQa3bg74-oIocf_WaE2kvIbvNkC5ysX9yO3k7SmXLB_2JJE_lni57yLoOsHUQ==)
3. [github.io](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHDhUe0Jk8EgZQ2W9Z4y8A0EfNwJm5Uu1JPebSLu4Ja9zZdNs3F_9V2TGXyqDACabA6CFAzsFQ9iST5qKNVGlEfCtWpDZnoduM5y5SsknL-ZP0Y4dsepBGCfzAu9DDSXN6uPEXqljLPY-zwoCZbeLjowyDQLUGqOwV8LobjPUZeyrNU)
4. [medium.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFOSa4xfzvbRtK3-VjlYhsq70Q7f1b1JFBSqJm_-i-0isntpoJ-T-n97okP3IJNZV66g_kMly2UlQ656x-FtKgM2zSo1G7A3aJx8FZfnHLPGfFPCwfqfq2uPw56KX_0a_HJTZlIWwLAwIoCQ2gIjTdrwagiQavuea8Akr5iXAFWjs1UVfZjBhS030r3qgYyILQCGQy2x4nTehgeeRbkgU7vAL0=)
5. [securityaffairs.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHx35_qXO2aejsRAx2Rarr_xtvdTr1X8Uay-1m1xoTpsNSK8WeLU470zOIFDyzQVGC9wD-9UVnausfmH_o89oMiQncTg-ZnlJVvpsB289iJLOwwOU9f182I1dXYSRaSHlu5LilUesopPb_ajUqnbidjWs9Wfquxt04sbLL9fA==)
6. [dennissalzner.de](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFJw9RqYHz_XUOaOBmK9VLcDkksgbsjhdl7l53MiTtDary9IHts3rzeMexCitsbHtjgjmAyg1O0Gw9G2kTZW9JCU_4w8VseaDVRexZhyXmr2hLJfiXv1uthlx0YmVXMQmUn10d8wOJshUKAzRI-Oyi4WwgJ4INVoAuiOnNBi6nbG5y9-Y-l)
7. [sans.edu](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFNSGOg-O3faNz4pPiMOU7JN2DcPaQ83rueVkCC_MvCoAW1Uo2ZOO0m-bBHMOXsVs0BJJWy3ZMDHuo3pimFVAVM9jbqy3INDNbGalTdguZF8ftpH-o5)
8. [iij.ad.jp](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQG4fubAwJL8NIYcXITg3g4lEVzcG84pX-FB17cWols8j2H-zHZE1MC55A9ThgVRuP-BId5w-WEIwxb2-wn_wKA7Bc-GXWF1D-ucTRF_KbEA24uRisSbtF_OjSY5_7aXL6ukCVpLlI6ZQw7cg-wK6ye_3bNl)
9. [ipinfo.io](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGlXbdwgkpNzl6NAOSsOl6p3jVZzCT_eG4jHkXrKQwAVQPx4VwS4Sfl3K4VMB7Ok31HmHdSWzjA5gchng4koAz1-3Dcw30zq26hBo28WR36GgH8ACMq9arUuNoa)
10. [bgp.tools](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFjAQodJ8DvXY5oO884RsfnyaJt3pj_hGqDNa1GZWqzEeDw-5qJc7sSS75Nq8ORx_eHSKG__wSxz-nSUMtPmN4-NxodP-1qDDiaieSir1HJrA==)
11. [bgp.tools](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGwdOlkp9uLaxfGZtkeD4VOLxRfJIcBmj4J1Bbc40jzfPxGbYZYzyJt2j4z_NVbarHjsBf9c5-_0CnADm0MVUchZNQS3hd_c5kX2fFLhp2tlQ==)
12. [cloudflare.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGih2Wdal_K-eb6WQ6ld2jEMW4-6bo3mcIxvTEufqZW7CEOL2emNjOdH8krgsvgaRaWesREjDMfeymIt6UanLIm6Bf3DvH04yoTUigPktw21AuzXx93pma0oqxR5_YKbfrSMWzZt4dx9vGU110YUToPmde4JyNM5vaO)
13. [peeringdb.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHZL0XOK2ovABG5xX7twXHVkC8ATnfCEQp8RHcY83NYm7ghBEgm1Np9mlNWmfw4ey_H76YmwHNi9OEqv939ETJArYcK7xWpPtwU9zSkbYNJRl9b0YtfxYS5)
14. [bgp.tools](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQF_-KdRKMkAfpj1uMUwg6qo0SWFC-uE96q-CsfwKRpQoLPGBvuvM7fJS3fKuQQFXyOPhbV8hbsH4motD25cOb8V7VdhSeCPUCFubDOX7Xgj)
15. [infosecwriteups.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEDOm8L_GhcQ1QM7ksXYGpAMX0ecIs1su_UO_6OTKW1WBMnKxfaBeWMaPUR4JRDaorNkDeBjro3WVEsdV95YgWCWcaCF5Zt9BqN927astTW46scGportNs1yaxRp4OpJeYmWxS2MgokpnWmCFiugm932OZAu1LFrplo_CBib8wH-xM_1bhCT2TYZpdroFXzjfVlHM7u8w==)
16. [riskrecon.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEVogWJ23DJJx6BdMqDj2uQKZJCtK0LAEa77PdV2YHa7GC52ngH8HAzrvhmhoIRwi9UToB622OSZAA3ZbUwYyU0GBbv6dUrx8N0MhBpBVzzsZkt3VO7Z1jTdOxQEq686jkpGwrg5H1ooXjbz8hc86Nqk6kZIu4=)
17. [sans.edu](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQG-zcG7k8B5egaqSbVBwnnv7YhqHe2FFaUbxjvG4qbLQABx-VLooZ0RqfYgjdoPVEq15-Z3xLtRf0aJar8TrqIwruJo8l-xPSNzC-ivy3i10Jhebm_j)
18. [jonsdocs.org.uk](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEs7LMy_P6jCzFdWezX5oMdkPUmTag8Fa5suSseVPONwLdHt8w1teI3YlTu4K3hKhVLQAQwLEwJ-9haiJH2K5sKzF3Eyjmzy3z6WQNnR8F2TZk-pJrRGAXa8dsvNEEOUdDKasBAjZhir6v4exKg1pBKN0itnDKH641_ST-a)
19. [sfu.ca](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEjHWR2XLfkGrCCKi8lhCPou-O7neiPQggf1dQOjapgb6VO82QgCynGtc9ee5eHGXLjWCa8EXHIICum8av74k2JF0wLe-7Btc8_lvJjHU4SBkMSz9ldNPXgqCmq0sju2v8Ipr2LWL5sWsvzUih1VHT7ZbamdnfeHOlM0kvMqJz62Qtpy7Rdx7FJqc8Z-Ug=)
20. [tehtris.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGLiS6qA7zg_zLpBiYsyv5tfaW4S0vPfSLza6NPDMqcue3cyh75Qixr3uWWcIwMSYLyYrb5KaIGiXsAQaaECjU6wKtNE34sjc6eS-bpKcbo7fqDz2PaplNzamEqSYRQbZAd6CLMabtlLLQkuXD1kP0-TVRS)
21. [gbhackers.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFR9kjyHKyIlwKi0C6GyDFUGxRGCuxHzxU0FTbcoDvjbYYVdoG7DfX3OnNmXNCtfPsdbz8cQBkN95Q1yrduA1kQRHvx95xXp-B_h-a_lxZAUPNY-xD12tOISeBIl0EJGqHYWqVqWob_zAia6PGclStzNz7kZQ==)
22. [securelist.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFg4LIbj3diYLCPZpUU7fAbZctP9wLDjOakAXHK7u2wHb7DdyeUmlQc73HlMxf9-blHL27ciIUOygsFssLCTHtp_DNkt_zsvsIMAQ8di4KX-u6fnFUpnbAqiQW_-zra827p)
23. [elastic.co](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFTS1uI0jyjx0vaPWTbMuTj-CKXmIOXHPxQImGDSBHkaY0WNqjCBaUlJyuepc0c2HtRZDpubjDsLjTf3GYEKsWVFopIlYJTgPeYcxlZYY8h7q2Id2bXvYEDkITnE6M5yn0Umi1qNFbzbF8-ddz4vA==)
24. [reddit.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQH95JV-KmhBrjEA_nUUc0Ry7xiMLu1ST0hslvEEEGnn3c8dHN8QxGAgNwV1ELpqsq2zE0CbmXGW--aqbtmOCis5MXKSyzBHYhCTUMYR4zFyS6h1NNHUclm99GPw_TkzN7ZJI0d3JBiXma1v4fUUQ0z1XaXgBErWJpu2hAvRinMxw2Xo8nXAzU_CR-UtxXr1bMgembpHHE1oU1R7ZF4=)
25. [port22.dk](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFoSuft41NJZBp10_7W-Smyk3vcz_Lg6vIMxsmHt7LRtuNWrDpIZY67cPtWH2LNQJAOU2gNIyIPAosIIsQ_I3qiAIczsxUbhsNnpiWW5FdLYWCO6AvMFTqAqDGDEd46)
26. [codyskinner.net](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQF6wTdxukLbXHBz6NF4cQhq2vjCgh0TaVcT6xYjQ0tVBH0RWgpFsnZHy0jXBLBFzWzMSOjyoHl9DzWj0i-fhY9XnnVvc5osvMUrcp3gVqIuRznZJ_ZBgWgNgx2O5viA6UggfZWivM4mheiz4CY6vZtga2nvxg7cw3IngkV5irK_RUczIJs=)
27. [cyderinc.net](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQH_1d7j4mbYg7Jyb7Z9_HWIuvtpqmzPm1Y9cjIlsK1c4iAj5NwF1b2P3Ls2u1rQsyW4rc-B3yAWqu_0PpAfb8FWmYDemhXFRvXgnL2ySUNUQFxVRqnZMkPG5Ozv-drjCMzC9D25nduqA_CrnC2QIyI4rqqPqNmcEoifhJyzOre9htspZ-55OiTls72YPcmE)
28. [sans.edu](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQE2gNei8LlxgE_9SW-G65kr1QFw1qgJm-4yzEaQpg2ZQJOoR5rZPltTc4my7TZ-pKxkACNCN7T_Q5HyvXGtQu-29N-PrEH4lWlYz4Igut21-ivzHwnu)
29. [sans.edu](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGFotKqVKZFIcYfaBqD2s2_PvlWkWhpQq6FQ5Tx7Nuxxp1wAqE4MuqVJNL5y25E1J7beYTqbKKnb1rkUcQ6dYXDC_bBba24bsQaNQly_hQUL7r5isa3)
30. [github.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFV5WLEcHLlQxL8Z7oQS81I4Cac5MUB4qEv2TyDrG1HPcreaIpO0SthHh35IRW9ByIj6KVpDBo_24Dy_8L2lMKyHyIYC3VweeFFg_aGlNA0d7epHexZKlIl4T4uwq9jSw==)
31. [securelist.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGfdPPII8GP52gyor1t56_tiK2TqRDvtHdLbKGZtcUcbPMYEo067E83dIacOL942dUMZc7EIcjzJHrZDnh1115pLYDNa_OvVmlwxOtuhn5nRqQ9lWjf5hyOzxb6kTlymHqJPZ5YGsrdDPmvLBSvDpdG3kqXOcO6XMnZOmQzPBKwhXM=)
32. [cti.monster](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQF8Q6ePUvOps-n0BEu0gIIpVg7yKW5zQiD5Vp9SIh9CgZn3Zqixh1Cepp9K3nnUOmphIe76xBNrhHN8PG8Wz97K-ndvnQLontITyVWMXRc6JxemqSvRkILv3cINUVf7udR7TicgT5lI7FVZ)
33. [cloudsek.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFz1_lGoVlbLbtwvA0wgAs-EsIz36DBnNU9yJp00fxAvxpwAVT4ixgRzg3wFILtvX6TNg8LK3KmgWJNj0f90crR70CRv6INYnK8T1EYnmCD5WxYsY9wB-e0yl_7zc_WpeX_gSddG40VwTYYBEb9aYFPu8kbhJJ4PM2nFHRk_Wm0GJyAkMWGIK6TPfozKa4Gx8E3kewwotK842EYM-vKlVvkWbA=)
34. [infosecwriteups.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHG1K8gZqalyUZXt6KLqdzGJb9PaeCr1lKX7SJJPGQJV6JposAXMrCYUERVK1u1zKC7cAPGvLy7GXzhUTqVgMGOzTGPIM5CnrrmsM4LbQUvZZBpvOozKWkaVMpNNxMKc64HlJ-6Bt3BHS6qJ0MkiBqwxGTcp4GRvfIfX17rMYyAmAzAR-oeZqhcn4uIcPDAvTNSA0mgAldbnHo=)
35. [github.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHk3CkMbKLGnVu4m8lmfNWl25oLUFZi3pIru7pjoRs13wwQJrz-KjwR3VsZGqMRx7tGG63E1r6dLqoHDeuOYqGaUUI-zFjT3EG95-crSaUlC4_qNXuA3K5m7JN4SD2KHXE=)
36. [sans.edu](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQG2-h4XdGd-shICG8jessXJkuT39vh283LOEELZZH4D2rxpFq6x-b4h_1mQG8kzQPE7Q56O_pM09oCseGFEyAnf7xhFysIpbww-EXGXr31GJJIHQt99)
37. [abuseipdb.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFMPKN6ICzBU-yzSpIRtLhm5I5rNNLHEZW-5cMdyDpuA2SjEORUhhEDCq9X_y2oys9Fu3mhIJi9BLvpntuwB4oOhR66dANe8yUXFcdD-MJujJvSbRKIO5vSFkhTMOop692jKDk=)
38. [abuseipdb.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGgubNR53DsA7fE-i0AjzDLWQNCQ-FRdgLckfRH5pGpfwK2-GEhFfT06tiEZ88rKBYG_Px4dtYgbFoKXnmmQQ1YEMLKw__fEV77QmSe3WIBX1t2FQzhlPA2DZ3DVP8O5f6TxA==)
39. [pfcloud.io](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHT2IsQtjti0ajZzyHTnswPo0L4_nUpz78adEQGDxWjnhGZ_2XmG6Jy4TXnUoiJZGnPR6OCGxg1-Drtq5j1go-hAYIq1pb6rTI5zn1g0rs25sCbpbDd4JpE_WD6Vcz7H56eas2RQ1pnFN8hz3wDTWZdmbMWit5kHw==)
40. [ripe.net](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGE8aeeN7VZOewm5fY5tCiHFN-ARFCzywa9rukQSk_smXu7jELbadRULZSpGXCieFFeFxw5rqll61ockpPHL8h-wr6fXmRLvAZB6Prv5bUUx85Tb658Vjo6X6Sbj-sn_DpkHFGN03cNdtfIWZiIUnsi9_L1nvRbfHMOm-AV9Wrc2tA=)
41. [usenix.org](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFbJKcRcczNe2qVQqKfQ7QaooNV0b_g4WmfIo8NiVTPqntfidmjod-nSDpVXz5t9sYVe_dH01dtudfW-PDuICTjcvetFUuea4iD6Tirl4PZW4y17zMS6VlDBvUDqp0UqCZujCLXzzxjLHvI1JH1Sopw6wB-qfKM)
42. [ahnlab.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQE9YTFhTQwHyJtWwXRcBu8nY_qya5GeFtaf5B_aKeXplR1SjlsmBWZI8y7w_3K1mb5-LJR1YFRO3i9pOSWJ93k3_s2s3zAQtwqfbl307guuryZ_mVh8lw==)
43. [edie.io](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFCZXCnJEwvvj1ot1vp2jAS0XBqmYNZemCaK6KaJ75mcG4IQvIlqGLnOrcE5SsdQo6b2LrAbSUC1HQ0_chf7mPrxDCSA6PoazZQGV2j_g4_TUP_wDYEdxG2rlpbauHpcYFl46jz8t9HTN96RzmKMO2oEFQrv5MHTb9MLQ==)