T-Pot Multi-Sensor (Sydney).

# Threat Intelligence Report: T-Pot Combined Sensor Analysis – NadSec Sydney (January 2026)

## Executive Summary

**Key Findings:**
*   **Dominance of Brazilian Botnets:** A massive 45.5% of all attack traffic originated from Brazil, primarily driven by compromised residential infrastructure and small-to-medium ISPs (e.g., JL Informática, R3 Telecom). This suggests a widespread campaign targeting vulnerable Customer Premise Equipment (CPE), likely MikroTik routers or Android TV boxes.
*   **Resurgence of Mirai "Pandora" Variant:** A specific Mirai-based botnet campaign, utilizing the identifier "Pandora," is actively propagating via shell scripts (`Pandora.sh`) and multi-architecture binaries (`systemx64.arm`, `pandora.mips`). This campaign is distinct from the Windows-based Pandora ransomware.
*   **Persistent ADB Mining Operations:** Significant activity on TCP port 5555 (Android Debug Bridge) indicates a sustained cryptomining worm (likely ADB.Miner variants) targeting exposed Android devices.
*   **Infrastructure Abuse:** Threat actors are leveraging "bulletproof" or lenient hosting providers in Iceland (Icenetworks/OrangeWebsite) and Moldova/Russia (AlexHost) to host malware payloads, while simultaneously abusing legitimate cloud services (DigitalOcean, Linode) for scanning and brute-force attacks.

**Assessment:**
The threat landscape for January 2026, as observed by the NadSec Sydney sensor, is characterized by automated, indiscriminate scanning campaigns driven by large-scale IoT botnets. The primary threat actors appear to be opportunistic botherders monetizing compromised bandwidth for DDoS-for-hire services and cryptocurrency mining. The high concentration of attacks from Brazil indicates a regional hygiene issue with ISP-managed devices, creating a fertile ground for botnet recruitment. The presence of "Pandora" malware suggests active development of Mirai variants, likely integrating newer exploits to maintain relevance.

---

## 1. Statistical Overview & Traffic Analysis

The dataset for January 2026 comprises 97,876 indicators collected from the NadSec T-Pot infrastructure in Sydney, Australia. The traffic patterns reveal a highly automated threat landscape dominated by legacy protocols and IoT-specific targeting.

### 1.1 Geographic Distribution
The geographic distribution of attack sources is heavily skewed, with Brazil accounting for nearly half of all detected incidents.

| Rank | Country | Count | % of Total | Analysis |
| :--- | :--- | :--- | :--- | :--- |
| 1 | **Brazil (BR)** | 44,587 | 45.55% | Indicates massive botnet infection within Brazilian residential/ISP networks. Likely compromised CPEs (MikroTik, Fiber ONTs). |
| 2 | **United States (US)** | 14,459 | 14.77% | Mix of legitimate scanners (Censys, Shadowserver), cloud-hosted attacks, and compromised servers. |
| 3 | **China (CN)** | 13,232 | 13.52% | Traditional source of scanning; heavy focus on database ports (1433, 6379) and SSH. |
| 4 | **United Kingdom (GB)** | 2,392 | 2.44% | Likely compromised VPS infrastructure and residential proxies. |
| 5 | **Australia (AU)** | 2,324 | 2.37% | Local infections; potentially compromised residential routers scanning local IP ranges. |

### 1.2 Targeted Services (Ports)
The targeted ports align with known IoT and database exploitation trends.

*   **Port 443 (HTTPS - 47,030 hits):** The top targeted port. This volume is likely driven by encrypted web application attacks, SSL/TLS probing, and attempts to exploit vulnerabilities in SSL VPNs (e.g., Fortinet, Pulse Secure) or web servers.
*   **Port 23 (Telnet - 6,004 hits):** Classic IoT targeting. Mirai and Gafgyt variants aggressively scan this port to brute-force default credentials on cameras and routers.
*   **Port 5555 (ADB - 228 hits in sample, high aggregate):** Specific targeting of the Android Debug Bridge. This port is associated with the ADB.Miner worm and other Android-specific malware.
*   **Port 6379 (Redis - 595 hits):** Targeting misconfigured Redis databases for remote code execution or cryptojacking.

### 1.3 Sensor Activity
*   **p0f (93,044 events):** The high volume of passive OS fingerprinting events confirms that most traffic consists of TCP SYN scans and connection attempts, allowing for detailed OS profiling of attackers.
*   **Honeytrap (18,246 events):** Indicates a high volume of generic TCP connection attempts, typical of mass scanners.
*   **Adbhoney (411 events):** While lower in absolute volume, the specificity of these alerts confirms active exploitation attempts against Android devices.

---

## 2. Infrastructure Deep Dive & IP Attribution

This section analyzes the infrastructure used by attackers, categorizing IPs into residential botnets, commercial scanners, and bulletproof hosting.

### 2.1 The Brazilian Botnet Cluster (Residential/ISP Compromise)
The anomaly of 44,000+ hits from Brazil warrants specific attention. Analysis of the ASNs involved points to small-to-medium ISPs (provedores regionais) rather than major carriers.

*   **JL INFORMATICA E TELECOM LTDA - ME (AS265410 / AS262825):**
    *   **Profile:** A regional ISP in Brazil offering fiber optic and radio internet services [cite: 1].
    *   **Threat Context:** Multiple IPs from this ASN were flagged as "scanning_host." The infrastructure likely consists of residential fiber connections. The high volume of attacks suggests that the ISP's provided routers (CPEs) or the devices behind them (Android TV boxes, unpatched PCs) are compromised en masse.
    *   **Risk:** High. Traffic from this ASN should be treated with extreme caution as it is a verified source of botnet traffic.

*   **R3 TELECOM (AS270606):**
    *   **Profile:** Another Brazilian ISP providing fiber services [cite: 2, 3].
    *   **Threat Context:** IPs from this network are actively scanning port 443 and 23. Like JL Informatica, this represents a pool of compromised residential devices.
    *   **Attribution:** Likely part of a Meris-like or Mirai-variant botnet that exploits vulnerabilities in MikroTik RouterOS or similar ISP-grade hardware often used in Brazil [cite: 4].

*   **MANALINK PROVEDOR DE INTERNET (AS266071):**
    *   **Profile:** An ISP based in Cubatão, São Paulo, specializing in radio frequency and fiber optics [cite: 5, 6].
    *   **Threat Context:** IPs from this ASN are participating in the same coordinated scanning campaigns. The geographic concentration in São Paulo aligns with the density of regional ISPs in that area.

**Conclusion on Brazil Cluster:** This is not a targeted campaign by a state actor but rather a "pollution" issue. A vulnerability in a popular router model or Android set-top box distributed by these ISPs has likely been weaponized, turning thousands of subscriber lines into a botnet.

### 2.2 Commercial & Research Scanners (Noise vs. Threat)
Several IPs in the dataset belong to known internet scanning organizations. Distinguishing these from malicious actors is crucial for reducing false positives.

*   **Censys Scanners (162.142.125.0/24):**
    *   **IPs:** `162.142.125.47`, `162.142.125.125`, `162.142.125.217`.
    *   **Role:** Censys operates a search engine for internet-connected devices. These IPs are whitelisted scanners used for research [cite: 7, 8].
    *   **Action:** These should be whitelisted to reduce log noise, unless the organization wishes to remain "dark" to search engines.

*   **Shadowserver Foundation (64.62.156.0/24):**
    *   **IPs:** `64.62.156.152`, `64.62.156.52`.
    *   **Role:** A non-profit security organization that scans the internet to identify and report vulnerabilities to network owners [cite: 9, 10].
    *   **Action:** Whitelist. Their scans are benevolent and intended to help remediation.

### 2.3 Malware Hosting & C2 Infrastructure
The most critical infrastructure identified involves servers hosting malware payloads.

*   **IP: 82.221.139.173 (Iceland)**
    *   **ASN:** AS50613 (Advania Island ehf / Icenetworks Ltd).
    *   **Hosting Provider:** OrangeWebsite.com [cite: 11].
    *   **Role:** **Malware Distribution Server.** This IP is hosting the `systemx64.arm` binary and other Mirai-related files on port 3712.
    *   **Reputation:** OrangeWebsite is known for "offshore" hosting with strong privacy protections, often abused by threat actors to host content that would be quickly taken down elsewhere. The presence of Mirai binaries confirms this host is actively supporting a botnet [cite: 12, 13, 14].

*   **IP: 193.27.90.4 (Moldova/Russia)**
    *   **ASN:** AS200019 (ALEXHOST SRL).
    *   **Role:** **Payload Delivery.** Hosted the `Pandora.sh` script [cite: 15].
    *   **Reputation:** AlexHost is frequently cited in threat intelligence reports for hosting malware, phishing, and C2 infrastructure due to lenient abuse policies.

*   **IP: 172.105.186.117 (US/Germany)**
    *   **ASN:** AS63949 (Akamai/Linode).
    *   **Role:** **Compromised VPS / Attack Source.** This IP was observed executing WordPress brute-force attacks (`/wp-login.php`) [cite: 16].
    *   **Context:** Likely a legitimate VPS that was compromised and repurposed, or purchased with stolen credit cards to run attack scripts.

---

## 3. Malware Analysis

This section dissects the specific malware artifacts captured by the honeypots.

### 3.1 Pandora.sh (Mirai Variant)
*   **File Name:** `Pandora.sh`
*   **Hash (SHA256):** `d3fd9994b16dc9b14c29f7faf7b5f6c84f44b06fccf82f0031a0871ce5e20e17` [cite: 17].
*   **Family:** **Mirai** (Linux.Mirai).
*   **Functionality:**
    *   **Dropper Script:** This is a shell script designed to identify the victim's architecture and download the appropriate binary payload.
    *   **Execution Flow:**
        1.  The script attempts to gain execution privileges (`chmod +x`).
        2.  It iterates through a list of architectures (ARM, MIPS, x86, etc.).
        3.  It attempts to download the payload from a C2 server (e.g., `http://95.214.27.161/Pandoras_Box/pandora.mips` or `http://193.27.90.4/Pandora.sh`) using `wget` or `curl` [cite: 18].
        4.  It executes the binary and often deletes itself to hide tracks.
    *   **Target:** Embedded Linux devices, routers, and IoT hardware.
    *   **Note:** This is *not* the Pandora Ransomware (which targets Windows). This is a botnet agent named "Pandora" by its authors, likely a variant of the Mirai source code [cite: 19].

### 3.2 systemx64.arm (Mirai Binary)
*   **File Name:** `systemx64.arm`
*   **Hosting URL:** `http://82.221.139.173:3712/bins/systemx64.arm`
*   **Family:** **Mirai** [cite: 20, 21].
*   **Architecture:** ARM (Advanced RISC Machine).
*   **Functionality:**
    *   **Botnet Agent:** Once executed, this binary connects to a Command & Control (C2) server.
    *   **DDoS Capability:** It waits for commands to launch DDoS attacks (UDP floods, TCP SYN floods, HTTP floods).
    *   **Propagation:** It contains a built-in scanner (telnet/SSH) to scan for other vulnerable devices, attempting to log in using a dictionary of default credentials.
    *   **Persistence:** It may attempt to modify system startup files to ensure it survives reboots, although many Mirai variants are memory-resident only.

### 3.3 ADB.Miner (Cryptomining Worm)
*   **Indicator:** Traffic on port 5555 with payloads containing `CNXN` or shell commands like `wget ... -O -> adbs`.
*   **Family:** **ADB.Miner** (or similar Android mining worm) [cite: 22, 23, 24].
*   **Mechanism:**
    *   **Exploit:** Targets the Android Debug Bridge (ADB) service left open on port 5555. This interface allows unauthenticated root access to the device.
    *   **Propagation:** The worm scans the internet for other devices with port 5555 open.
    *   **Payload:** Upon connection, it pushes a shell script (often named `Invoke.sh` or `adbs`) which downloads a cryptominer (usually XMRig for Monero) and a scanner module.
    *   **Impact:** High CPU usage, device overheating, and battery drain on infected smartphones, tablets, and smart TVs.

---

## 4. Campaign Attribution

### 4.1 The "Pandora" IoT Botnet Campaign
*   **Attribution:** This is a distinct campaign run by a threat actor utilizing the Mirai codebase. The consistent naming convention (`Pandora.sh`, `/Pandoras_Box/`) indicates a specific botnet operator.
*   **Goal:** Recruitment of IoT devices for DDoS-for-hire services.
*   **TTPs:**
    *   **Delivery:** Exploitation of known vulnerabilities (CVEs in routers/DVRs) or Telnet brute-force.
    *   **Infrastructure:** Uses bulletproof hosting (AlexHost, OrangeWebsite) to host payloads.
    *   **Evolution:** The campaign has evolved to include Android TV targets, as seen in reports linking "Android.Pandora" to pirated video apps and firmware updates [cite: 19].

### 4.2 The Brazilian Residential Proxy/Botnet
*   **Attribution:** Likely a decentralized botnet (like Meris or a Mirai variant) that has successfully infected a massive number of devices in Brazil.
*   **Goal:** The sheer volume suggests these devices are being sold as "residential proxies" to other cybercriminals to mask their traffic, or are being used for large-scale DDoS attacks.
*   **Linkage:** The high concentration of attacks from specific Brazilian ASNs (JL Informatica, R3 Telecom) strongly suggests a supply-chain or configuration issue common to these ISPs (e.g., a specific vulnerable router model distributed to customers).

---

## 5. Infrastructure Mapping

The following diagram illustrates the relationships identified in the research:

*   **Attack Source (Brazil Cluster):**
    *   `IPs in AS265410` (JL Informatica) -> Scans Port 23/443 -> T-Pot Sensor
    *   `IPs in AS270606` (R3 Telecom) -> Scans Port 23/443 -> T-Pot Sensor
*   **Payload Delivery (Malware Hosts):**
    *   `193.27.90.4` (AlexHost) -> Hosts `Pandora.sh` -> Downloaded by infected bots.
    *   `82.221.139.173` (OrangeWebsite) -> Hosts `systemx64.arm` -> Downloaded by ARM-based bots.
*   **Target (Victim):**
    *   T-Pot Sensor (Sydney) -> Receives scans/exploits.
    *   Android Devices (Port 5555) -> Targeted by ADB.Miner.

---

## 6. MITRE ATT&CK Mapping

| Tactic | Technique ID | Technique Name | Observation in Dataset |
| :--- | :--- | :--- | :--- |
| **Reconnaissance** | T1595.002 | Active Scanning: Vulnerability Scanning | Massive scanning on ports 23, 443, 5555, 6379. |
| **Resource Development** | T1583.003 | Acquire Infrastructure: VPS | Use of AlexHost and OrangeWebsite for malware hosting. |
| **Initial Access** | T1190 | Exploit Public-Facing Application | Exploits against ADB (5555) and Elasticsearch (9200). |
| **Initial Access** | T1110 | Brute Force | Telnet/SSH credential stuffing; WordPress login attacks. |
| **Execution** | T1059.004 | Command and Scripting Interpreter: Unix Shell | Execution of `Pandora.sh` and `systemx64.arm`. |
| **Defense Evasion** | T1070.004 | Indicator Removal on Host: File Deletion | Scripts often delete themselves (`rm adbs`) after execution [cite: 25]. |
| **Discovery** | T1046 | Network Service Scanning | Infected bots scanning for other victims (e.g., p0f logs). |
| **Impact** | T1496 | Resource Hijacking | Cryptomining (ADB.Miner) on compromised devices. |

---

## 7. Detection & Mitigation Strategies

### 7.1 Firewall & ACL Rules
*   **Block Malicious ASNs:** Consider geo-blocking or rate-limiting traffic from the identified high-abuse Brazilian ASNs if no legitimate business traffic is expected.
    *   Block AS265410 (JL INFORMATICA)
    *   Block AS270606 (R3 TELECOM)
*   **Block Malware Hosts:** Immediately block outbound and inbound connections to:
    *   `82.221.139.173`
    *   `193.27.90.4`
*   **Port Hardening:**
    *   Ensure Port 5555 (ADB) is blocked at the perimeter.
    *   Restrict Port 9200 (Elasticsearch) and 6379 (Redis) to trusted internal IPs only.

### 7.2 SIEM Queries (Splunk/ELK)
**Detect Pandora/Mirai Download:**
```
(dest_port=80 OR dest_port=443) AND (url="*/Pandora.sh" OR url="*/Pandoras_Box/*" OR url="*/systemx64.arm")
```

**Detect ADB Miner Activity:**
```
dest_port=5555 AND (payload="*CNXN*" OR payload="*OPEN*" OR payload="*wget*")
```

### 7.3 Snort/Suricata Signatures
**Rule for Pandora User-Agent/URI:**
```
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Pandora/Mirai Variant Download Request"; flow:established,to_server; content:"/Pandora.sh"; http_uri; classtype:trojan-activity; sid:1000001; rev:1;)
```

**Rule for ADB Exploitation:**
```
alert tcp $EXTERNAL_NET any -> $HOME_NET 5555 (msg:"ET EXPLOIT Android Debug Bridge (ADB) Payload Push"; flow:established,to_server; content:"CNXN"; depth:4; classtype:attempted-admin; sid:1000002; rev:1;)
```

---

## 8. IOC Appendix

### Top Attacking IPs (Sample)
| IP Address | ASN | Country | Label | Context |
| :--- | :--- | :--- | :--- | :--- |
| `101.36.97.74` | AS... | GB | Scanning Host | Multi-sensor detection (honeytrap, p0f). |
| `176.32.195.85` | AS... | AM | Scanning Host | Telnet/Redis targeting. |
| `80.94.95.75` | AS... | RO | Scanning Host | ADB/Dionaea target. |
| `165.232.66.142` | AS14061 | DE | Scanning Host | DigitalOcean droplet, likely compromised. |
| `82.221.139.173` | AS50613 | IS | **Malware Host** | Hosting Mirai binaries (`systemx64.arm`). |
| `193.27.90.4` | AS200019| MD/RU | **Malware Host** | Hosting `Pandora.sh`. |

### Malicious Hashes
| SHA256 | Description | Family |
| :--- | :--- | :--- |
| `d3fd9994b16dc9b14c29f7faf7b5f6c84f44b06fccf82f0031a0871ce5e20e17` | Pandora.sh script | Mirai (Linux) |
| `048e374baac36d8cf68dd32e48313ef8eb517d647548b1bf5f26d2d0e2e3cdc7` | Dropped binary | Mirai/Gafgyt |
| `5f522e269bf35cf78d80e6341ec953775adbffaf35871f710255f81d5ca0723c` | ADB Dropped File | ADB.Miner |

### Malicious URLs
*   `http://82.221.139.173:3712/bins/systemx64.arm`
*   `http://193.27.90.4/Pandora.sh`
*   `http://172.105.186.117:8080/wp-login.php`

---

## 9. Sources & Citations
[cite: 1] JL Informatica Corporate Profile.
[cite: 22, 23, 24, 25] ADB.Miner and Port 5555 Exploitation Research.
[cite: 17] MalwareBazaar Analysis of Pandora.sh.
[cite: 12, 13, 14] URLhaus Database for Mirai/Pandora URLs.
[cite: 7, 8] Censys Scanner IP Ranges and Opt-out.
[cite: 9, 10] Shadowserver Foundation IP Identification.
[cite: 11] IPInfo/OrangeWebsite Hosting Details.
[cite: 18] Sysdig Research on SCARLETEEL and Pandora/Mirai.
[cite: 19] TSFactory Blog on Android.Pandora Malware.
[cite: 16] Cloudflare Community on WordPress Brute Force.

**Sources:**
1. [jlinformatica.net.br](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQERyrfqYGrgBO2oQ8SBchOSobWZiwSJQy3bjL66mFmpleIoLwYw_tsc1NFbsvbtiiZiIb7PUUMG0NEqlSqYHaIfouoHQUftWW5EwhmwBsXOwc2LEFympPw=)
2. [ip2location.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGpQDlbHkDQm88WRLT52Vs4jpgHTami95gE-EybbwLFaY7mrCL_YfolKmzoMLhZJWp2mDxeaoDxmoQL4dlzN1VIj-HcMu0YYZ2t7q6ouTibeYfUSK4m2RqcDE5sKkRiRguHaeo=)
3. [peeringdb.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQG1YyNE0WauScpjL9K0FLcDHzzfDtUWHc9JkhC1IP5yc6HFDwMaSsjKytwkfhbaj634mfNPV4oc2YSrWKRZJHodseAa0fXWOF1xOJj7vc3WtoeMkEeOn4s2cw==)
4. [rondonia.ro.gov.br](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGX5SXVjvns04P5jdpfzERfBWNW7IgHAw6EFpTzbHdfMKfPF9tEeAf3cg-UmtLCPVWApsW5K-eOsa4N3zQrITZ3YMoX26WKFl7KxF2TcCLbem-3rz7PHb5Bd3UEXbpHBxxHzkeR0_d-q7g3fRF7M-fYC_anotTiVLV1uxaRK_cm_mxlEgNot_eGRg==)
5. [manalink.com.br](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGzU2aG-Y_y3Bg3DQxgyaXr1WOZxjsaifrEK1yOOpAAPkVYxxF-9PZJTECZSeB8CbNLPxdBqQK_5ZTQ3iTl_jGgBgOU3KSek0v4LbYFiZOdcemM)
6. [manalink.com.br](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHSBPR_PkzqYoGZpnRn4kpxBWRJ9aepvnjStrGSNwuuBNMjUxCCnzXoDGkWzFRSRAqYAozaIQn6KybxgUkbvvzArQCnEi7Ku__lLP4otfYXLQBDadvbUIsi-2TfUA==)
7. [netify.ai](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQF5WuP7DGwT2pXNztuSop3vsRgf1pyTBfW5w6I2QBU6yZ-VOsHsqV_bFNOQIcqjbtY9UEQ5IL683yPGeK40DpZSZ3W7nnhdDUQ1bU_x1ofSGZd0_DIV3dj2w3UMAU3_Id8C0i6WatW5hPs=)
8. [censys.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGvp-cQ3HNuD_lQPoGqPmVhM2S13dahQCBq5m5Jw9xN7RDL1cbMpNX4UAZ9Sn2eaDERlXHeT1GCoxNT04fshmqi_Tj95NwNAjAY9xPn2iFYjChwEPbLzapUkemJQ3I52rG96NOAITTa-z0_QuBE)
9. [ip2location.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFHnWtHh-hNEag-OCJPRy4TwqxxhSNvqOHoA8RXxCX-1gRfvaAXIZAUnhTSl3LDmxx6d-fw-KkKPfmEHGunUUcB9nMRiWZyanSKyjvE2P5Fa988-d4UhrFPXAkbhGxSGQXrV3o=)
10. [abuseipdb.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEAH6Y2lvZH6sM_OURNXzOzkQFaLN6AJP3rTAoLAebjGX5BkQb7Q3BFyf9SYn0ar7ZliYNfbPkCIPKd3KhOC1_D5yaxXdnKkU9YY8vB2CEcxualsijllwewHysN6rqJ5Y5I6g==)
11. [ipinfo.io](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQF6BV7JxBAzrM93J8TqlAwFI-DORuvkIf-1f75umbWolwS2QhD34S864Ol1oI-dxR5Tl_QLNSx3ORYUTbybMcfqSw3dBFSBhI3zoMrIh_Z-_-v6NX7RxA==)
12. [abuse.ch](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQH-iI0b33qfhtN2kBJ8XnH-_G0EaFfdIfBYHzSdMTOPrkHgQB3Sur6b1kv4nGtYV-SjH0AudIbGyO-EiDDcOlRx-QY7b7sJR6H8P33P2UEczBdZxEgfeYv89MevDue5EULstuE2)
13. [abuse.ch](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGKyJ1Rr70cWzhIV9ylh8fJ96XaJ7DVQdZ3oXApFDMTtiJ-88kB2MuxAZxCzJ4eXQBkHM_89hy7CxvYVNLgYSVsfjgXMtBshFdWS0oJnTxzncNbkLk-9rzG6RbAkt7Pwert0AqeFA==)
14. [abuse.ch](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFn0m-Tsl3K9IcD05IZCYfsjMh7KOb6QjGkFwkudBBGjKJrkuGcHJwZpRapke0QRjQUWDu-QMTtw0CgmPB0bcLuVOAv_HzUSraC6CPr3RtpHDikyW4QZ30dMVJJwUNQ)
15. [ipinfo.io](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFRQV22pCF-C2reNaodeQNrG9rkWygICKhRH8Vny9_UXkmMAHZuZCdj8wb4Ql4Hza682hOSPsCDzJNqBUriTdi1mxz2eKQmskHzrsphFlUhm4ox8Zl16ukow1ByvV-riA==)
16. [cloudflare.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQG0Q66NmabQtOepj34lG4RHMd411q_oFgVpM2SJ45LrfP4hTv3HHXSHljCZt4VYvUvVrl8I6Qi2TM3WN8kfy0LB78v6atnZm_mUQpCaovA7pexaYZMNEJf7-Gdtfar735wwmgFadTM_n7yX8jGiPAq_PURXIqufdJBM3pTqbjYjSoutUB5W1lFFHjTSO7daFHKVPthJGAvlItA=)
17. [abuse.ch](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFfsz6gmBo8JEiECUcNLrMzRBucFoa2tXl0kAOkm1m0H5khHZL0ijLP06C5jMLQqcLNV1WX-spmnkKVZFxBZ9Ia_9UWvi6IYCrKjv_f4jcermijbD7EBPiAW7Ewfs94Mi8mYBdttVeQFtAV-SLEsBt6l9txEUKqB91-p1mjCSjmPeWHNagXY3dXJhBmDqdZyTKqK8qww8E=)
18. [sysdig.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQH442-DmBn_EB2cacnZvpUrC7DKYpdR9m2vErOMH1eMeoyRnTmgtPzRsBL9zbgcDZAHKjPHO4_D4i-rN6xNt9R9YkgzvnFSinipdw_naS6f2irmb13tgCeFB-NPZWoLK-gOi94QoaEa15k=)
19. [tsfactory.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEln04XaeDJUkR_EmgcdVbxR6TBhGOJoeyMFhwEq8HWuwMv_akl1kzmrB0qENxD01v0vq3AfNCijqksfWQqrI41vhqC7BoDG4RtmJzR__E2GjzFPZLPsYWtWAUM6JSSvZFJ1VfPv_InaluKBn3av_pwezQP88NZDCBvhmDiFAjntIR9itc4qF6MYlsUztv-2XJGU0JIbFi4yIxfzZhR3Q1UmrclEr3HO2g=)
20. [any.run](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHGd0r4TiOSczg57mptp6uQkxiDh1s4JsUx0spg8f-RVbq_F5QqyVuUt057QX7P01m3ztLvEwK8bbXYQBftKBxDZgnApmaJEbxEdFAMB1W8bH0Y507EJpAqvuVxsFPJXlJ4KaFK0cj_-l_6Q6_eWfq_MCjBpd22vpAPSByafkyU3Wjit9YZS_YVXBapsT7dmcwfupn8XNoDviiGy0d4sZrmmoAdQIBNo11EIChbTGayLGSq)
21. [abuse.ch](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQH1BKjVELccueloFRFBt6IOcPrMzCSJ9iMYP3ZuovnehbI8SanP50bFeTow0-8iDNR6pt3CLJPOTVvvtMn2hRTLYVbco22j7f7nYWCz4ImnBkcgNVaSnelkSbw5qGREBlDwLfhLu0g9yB-zG-iJBkIoM1cZCTCxk6LiyKQshmhgYGg1DKhIh73lNJwJjzflqcLhKARX91g=)
22. [bitdefender.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQE5NxJnc42auyq-GtYboyPsqkjDMzzrFkLADpftq8ACiT7HpxBQQb2gyWsS8PDoKgZBd7S3hRGBGWbLIG0vyivS7vnTkg2flf-f6WUx-f94by8ZOVERB-06-gX9_QjqYUaoORQRCOpPq_GW8mUeggcdhy9LEzXAGZe627hB_dHQcMKCWLd1t4wkh7SCYtPd2wCuxNLK_WdaD4CqxsN7GZSw5mvt0G5F6nQqzpPPgLyMn1uYiSmb)
23. [trendmicro.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGm-eP3pr4AviyzYiB3tMRBs6l2hL5DSred1MElk-28uNMPXUprEKq0uVNennb-HdLAMS_K8MhwN06iBDIy6_nva71v-wfApEXbBFLR6AJUuRb_rNZwxI1M5EGgsNYnFpWectHEJ0sZnyQqJ1XiP4S8AU-0mB_SHxWDI4orM5T1v96syqET1KebpYX0Y0t6e83TeMo77ZjBa8jsGHFJGtWAA4q4-3ptLFiWfJyuvqe8dNpLvnXVsf2POT4u97FY)
24. [scworld.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHExL7ep0kFUhar4Lp-wpMy8apciCeGnd4ETuGbYdEI4TdB_fZQ5WggmDrr2nMdjnEzdQV-3t2GzTHiOyFNKKEImd4Rcjr5vfdBALkz7ZpmG3fuGCF8kSoWnmeV0YEh8L7Y0A7oVzElQiXGznIoek2u7i1QxSo-ae8tOC8lLCHrpNW3eqP7SeBQPJm6rxTyT-XH_zJPJ8y0h2wZ)
25. [sans.edu](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQElREGQCZ1odN1zkATjXD23XU2IWj0lS9F1Ss-yQ878QKKZKZVtUJX-Bh-ZbaLI8rzrnzBdzzO0FN4YjMHzBouZoznEEHqgY_rxojVtYkUlCaOfZ6XEsw==)