{ "type": "IPv4", "indicator": "40.124.86.76", "general": { "whois": "http://whois.domaintools.com/40.124.86.76", "reputation": 0, "indicator": "40.124.86.76", "type": "IPv4", "type_title": "IPv4", "base_indicator": { "id": 4057954976, "indicator": "40.124.86.76", "type": "IPv4", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 42, "pulses": [ { "id": "5a64f74f0e543738c12bc973", "name": "Webscanners with Bad Requests - HTTP Status 400 - 1/20/2018 thru current day", "description": "Webscanners who's requests resulted in HTTP Status code 400 due to WAF rules or LB parsing issues", "modified": "2026-04-25T20:40:19.615000", "created": "2018-01-21T20:25:51.668000", "tags": [ "webscanner", "bruteforce", "badrequest", "probing", "webscan" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 385643, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "david3", "id": "2807", "avatar_url": "/otxapi/users/avatar_image/media/avatars/david3/resized/80/fireball-dwf.jpg", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 11243 }, "indicator_count": 11243, "is_author": false, "is_subscribing": null, "subscriber_count": 2578, "modified_text": "14 hours ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "IPv4", "related_indicator_is_active": 0 }, { "id": "69ec7a204b1d8d2b6371fe03", "name": "DigitalOcean London (UK) Port Scanning Hosts for 2026-04-24", "description": "IPv4 hosts detected port scanning DigitalOcean London (UK) honeypot", "modified": "2026-04-25T08:24:00.697000", "created": "2026-04-25T08:24:00.697000", "tags": [ "digital ocean", "portscan", "scanners", "honeypot" ], "references": [ "https://jamesbrine.com.au/digitaloceanlondon-portscan-bruteforce-ip-list-2026-04-24/", "https://jamesbrine.com.au" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "jamesbrine", "id": "83487", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_83487/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 3980 }, "indicator_count": 3980, "is_author": false, "is_subscribing": null, "subscriber_count": 1528, "modified_text": "1 day ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "IPv4", "related_indicator_is_active": 1 }, { "id": "697e9e9cd810b69811e492e0", "name": "Honeypot Data \u2013 T-Pot - Sydney, Australia - February 2026", "description": "Rolling monthly view for February 2026 of indicators observed by T-Pot CE honeypots. Each run looks back the last 24h and appends newly seen indicators for this month. Signals are deduped and filtered (min event count threshold; private IPs excluded). Intended for defensive use; infrastructure may be compromised or spoofed. Sensor: T-Pot CE. Location: Sydney, Australia.", "modified": "2026-04-01T23:56:12.846000", "created": "2026-02-01T00:30:20.205000", "tags": [ "tpot", "honeypot", "sensor-tagged", "cowrie", "suricata", "dionaea", "honeytrap", "p0f", "fatt", "mailoney", "tanner", "sentrypeer" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 12902, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "conrat45", "id": "280429", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_280429/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 154 }, "indicator_count": 154, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "24 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "IPv4", "related_indicator_is_active": 0 }, { "id": "697e97894fd746076df2a2a6", "name": "LCIA HoneyNet Data - February 2026 - Honeytrap", "description": "Data collected from honeypots in Louisiana. Just a fun project I tinker with.. data submitted with some gnarly python scripts for automation.", "modified": "2026-03-30T23:01:11.504000", "created": "2026-02-01T00:00:09.889000", "tags": [ "cowrie", "LAMP", "sip", "ssh", "cisco", "sftp", "sentrypeer", "honeytrap", "malicious" ], "references": [ "https://github.com/telekom-security/tpotce" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dm_lacia", "id": "132921", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": {}, "indicator_count": 0, "is_author": false, "is_subscribing": null, "subscriber_count": 357, "modified_text": "26 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "IPv4", "related_indicator_is_active": 0 }, { "id": "697e9788b7de070c0f68333b", "name": "Honeypot Data - February 2026 - Honeytrap", "description": "Data collected from honeypots in Louisiana. Just a fun project I tinker with.. data submitted with some gnarly python scripts for automation.", "modified": "2026-03-30T23:01:11.504000", "created": "2026-02-01T00:00:07.997000", "tags": [ "sip", "cisco", "LAMP", "sftp", "sentrypeer", "cowrie", "malicious", "honeytrap", "ssh" ], "references": [ "https://github.com/telekom-security/tpotce" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ladarrellmiller", "id": "111524", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": {}, "indicator_count": 0, "is_author": false, "is_subscribing": null, "subscriber_count": 435, "modified_text": "26 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "IPv4", "related_indicator_is_active": 0 }, { "id": "697e97b7b78ff64d0d1d4852", "name": "OpenCTI_Export_2026-02", "description": "Automated export from OpenCTI for 2026-02", "modified": "2026-03-30T19:03:16.662000", "created": "2026-02-01T00:00:55.684000", "tags": [ "OpenCTI", "Automated", "2026-02" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "info@watchtower365.com", "id": "67692", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 36525, "FileHash-SHA256": 3847, "domain": 1086 }, "indicator_count": 41458, "is_author": false, "is_subscribing": null, "subscriber_count": 36, "modified_text": "26 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "IPv4", "related_indicator_is_active": 0 }, { "id": "6955c00fc71c3eed5b3fa565", "name": "Honeypot Data \u2013 T-Pot - Sydney, Australia - January 2026", "description": "Rolling monthly view for January 2026 of indicators observed by T-Pot CE honeypots. Each run looks back the last 24h and appends newly seen indicators for this month. Signals are deduped and filtered (min event count threshold; private IPs excluded). Intended for defensive use; infrastructure may be compromised or spoofed. Sensor: T-Pot CE. Location: Sydney, Australia.", "modified": "2026-03-04T23:32:54.841000", "created": "2026-01-01T00:30:07.585000", "tags": [ "tpot", "honeypot", "sensor-tagged", "cowrie", "suricata", "dionaea", "honeytrap", "p0f", "fatt", "mailoney", "tanner", "sentrypeer" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 15130, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "conrat45", "id": "280429", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_280429/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 46, "FileHash-SHA256": 299 }, "indicator_count": 345, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "52 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "IPv4", "related_indicator_is_active": 0 }, { "id": "695f41d082836afadb04364e", "name": "Honeypot Data - January 2026 - Honeytrap", "description": "Data collected from honeypots in Louisiana. Just a fun project I tinker with.. data submitted with some gnarly python scripts for automation.", "modified": "2026-03-02T23:01:21.967000", "created": "2026-01-08T05:34:08.107000", "tags": [ "LAMP", "malicious", "honeytrap" ], "references": [ "https://github.com/telekom-security/tpotce" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ladarrellmiller", "id": "111524", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": {}, "indicator_count": 0, "is_author": false, "is_subscribing": null, "subscriber_count": 433, "modified_text": "54 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "IPv4", "related_indicator_is_active": 0 }, { "id": "695f24d7db4c0057d89f6bc3", "name": "LCIA HoneyNet Data - January 2026 - Dionaea", "description": "Data collected from honeypots in Louisiana. Just a fun project I tinker with.. data submitted with some gnarly python scripts for automation.", "modified": "2026-03-02T23:01:21.967000", "created": "2026-01-08T03:30:31.464000", "tags": [ "conpot", "honeytrap", "sftp", "malicious", "dionaea", "LAMP", "cowrie", "cisco", "ssh" ], "references": [ "https://github.com/telekom-security/tpotce" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dm_lacia", "id": "132921", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": {}, "indicator_count": 0, "is_author": false, "is_subscribing": null, "subscriber_count": 359, "modified_text": "54 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "IPv4", "related_indicator_is_active": 0 }, { "id": "6979ab617aff42b29f66fd28", "name": "LCIA HoneyNet Data - January 2026 - Honeytrap", "description": "Data collected from honeypots in Louisiana. Just a fun project I tinker with.. data submitted with some gnarly python scripts for automation.", "modified": "2026-03-02T23:01:21.967000", "created": "2026-01-28T06:23:29.109000", "tags": [ "LAMP", "honeytrap", "cowrie", "ssh", "heralding", "malicious", "sftp" ], "references": [ "https://github.com/telekom-security/tpotce" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dm_lacia", "id": "132921", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": {}, "indicator_count": 0, "is_author": false, "is_subscribing": null, "subscriber_count": 351, "modified_text": "54 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "IPv4", "related_indicator_is_active": 0 }, { "id": "697717160b5f9564b40ceb0f", "name": "OpenCTI_Export_2026-01", "description": "Automated export from OpenCTI for 2026-01", "modified": "2026-03-02T17:00:28.656000", "created": "2026-01-26T07:26:12.492000", "tags": [ "OpenCTI", "Automated", "2026-01" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "info@watchtower365.com", "id": "67692", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 10866, "FileHash-SHA256": 960, "domain": 86 }, "indicator_count": 11912, "is_author": false, "is_subscribing": null, "subscriber_count": 28, "modified_text": "54 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "IPv4", "related_indicator_is_active": 0 }, { "id": "695f12764535435504d2fb04", "name": "LCIA HoneyNet Data - January 2026 - Honeytrap", "description": "Data collected from honeypots in Louisiana. Just a fun project I tinker with.. data submitted with some gnarly python scripts for automation.", "modified": "2026-02-27T05:02:00.452000", "created": "2026-01-08T02:12:06.816000", "tags": [ "LAMP", "sftp", "honeytrap", "malicious", "ssh", "cowrie" ], "references": [ "https://github.com/telekom-security/tpotce" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dm_lacia", "id": "132921", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": {}, "indicator_count": 0, "is_author": false, "is_subscribing": null, "subscriber_count": 361, "modified_text": "58 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "IPv4", "related_indicator_is_active": 0 }, { "id": "695f247c33df844c87ea3d8f", "name": "Honeypot Data - January 2026 - Dionaea", "description": "Data collected from honeypots in Louisiana. Just a fun project I tinker with.. data submitted with some gnarly python scripts for automation.", "modified": "2026-02-20T13:03:07.577000", "created": "2026-01-08T03:29:00.109000", "tags": [ "LAMP", "sftp", "cowrie", "cisco", "conpot", "malicious", "ssh", "dionaea", "honeytrap" ], "references": [ "https://github.com/telekom-security/tpotce" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ladarrellmiller", "id": "111524", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": {}, "indicator_count": 0, "is_author": false, "is_subscribing": null, "subscriber_count": 424, "modified_text": "64 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "IPv4", "related_indicator_is_active": 0 }, { "id": "6955bca984b7c79797a8140b", "name": "Honeypot Data - January 2026 - ElasticPot", "description": "Data collected from honeypots in Louisiana. Just a fun project I tinker with.. data submitted with some gnarly python scripts for automation.", "modified": "2026-02-06T19:02:06.978000", "created": "2026-01-01T00:15:36.994000", "tags": [ "ssh", "honeytrap", "elasticpot", "email", "heralding", "tanner", "cowrie", "cisco", "mailoney", "Adbhoney", "sentrypeer", "sip", "sftp", "malicious", "LAMP" ], "references": [ "https://github.com/telekom-security/tpotce" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ladarrellmiller", "id": "111524", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": {}, "indicator_count": 0, "is_author": false, "is_subscribing": null, "subscriber_count": 425, "modified_text": "78 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "IPv4", "related_indicator_is_active": 0 }, { "id": "6955b9071848ff620d70e6ed", "name": "LCIA HoneyNet Data - January 2026 - Honeytrap", "description": "Data collected from honeypots in Louisiana. Just a fun project I tinker with.. data submitted with some gnarly python scripts for automation.", "modified": "2026-02-06T07:00:40.531000", "created": "2026-01-01T00:00:07.209000", "tags": [ "honeytrap", "LAMP", "sftp", "ssh", "cowrie", "malicious", "heralding", "cisco" ], "references": [ "https://github.com/telekom-security/tpotce" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dm_lacia", "id": "132921", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": {}, "indicator_count": 0, "is_author": false, "is_subscribing": null, "subscriber_count": 351, "modified_text": "79 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "IPv4", "related_indicator_is_active": 0 }, { "id": "6955b908c07770dcad81683e", "name": "Honeypot Data - January 2026 - Honeytrap", "description": "Data collected from honeypots in Louisiana. Just a fun project I tinker with.. data submitted with some gnarly python scripts for automation.", "modified": "2026-02-05T16:03:13.361000", "created": "2026-01-01T00:00:08.471000", "tags": [ "LAMP", "cisco", "sftp", "ssh", "heralding", "honeytrap", "cowrie", "malicious" ], "references": [ "https://github.com/telekom-security/tpotce" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ladarrellmiller", "id": "111524", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": {}, "indicator_count": 0, "is_author": false, "is_subscribing": null, "subscriber_count": 424, "modified_text": "79 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "IPv4", "related_indicator_is_active": 0 }, { "id": "6955bcb2a95347a135d161bf", "name": "LCIA HoneyNet Data - January 2026 - ElasticPot", "description": "Data collected from honeypots in Louisiana. Just a fun project I tinker with.. data submitted with some gnarly python scripts for automation.", "modified": "2026-02-05T15:03:08.890000", "created": "2026-01-01T00:15:46.711000", "tags": [ "ssh", "sentrypeer", "elasticpot", "sftp", "cowrie", "tanner", "Adbhoney", "honeytrap", "mailoney", "LAMP", "email", "malicious", "sip", "cisco", "heralding" ], "references": [ "https://github.com/telekom-security/tpotce" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dm_lacia", "id": "132921", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": {}, "indicator_count": 0, "is_author": false, "is_subscribing": null, "subscriber_count": 351, "modified_text": "79 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "IPv4", "related_indicator_is_active": 0 }, { "id": "69428baa34e26652c938ef2a", "name": "Honeypot Data \u2013 T-Pot - Sydney, Australia - December 2025", "description": "Rolling monthly view for December 2025 of indicators observed by T-Pot CE honeypots. Each run looks back the last 1h and appends newly seen indicators for this month. Signals are deduped and filtered (min event count threshold; private IPs excluded). Intended for defensive use; infrastructure may be compromised or spoofed. Sensor: T-Pot CE. Location: Sydney, Australia.", "modified": "2026-01-30T23:05:00.056000", "created": "2025-12-17T10:53:30.791000", "tags": [ "tpot", "honeypot", "sensor-tagged", "cowrie", "suricata", "dionaea", "honeytrap", "p0f", "fatt", "mailoney", "tanner", "sentrypeer" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 34679, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "conrat45", "id": "280429", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_280429/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 750, "FileHash-SHA256": 181 }, "indicator_count": 931, "is_author": false, "is_subscribing": null, "subscriber_count": 100, "modified_text": "85 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "IPv4", "related_indicator_is_active": 0 }, { "id": "692cda84845f2ef97b4c3955", "name": "LCIA HoneyNet Data - December 2025 - Honeytrap", "description": "Data collected from honeypots in Louisiana. Just a fun project I tinker with.. data submitted with some gnarly python scripts for automation.", "modified": "2026-01-30T23:05:00.056000", "created": "2025-12-01T00:00:04.478000", "tags": [ "LAMP", "sftp", "malicious", "cowrie", "honeytrap", "ssh" ], "references": [ "https://github.com/telekom-security/tpotce" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dm_lacia", "id": "132921", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": {}, "indicator_count": 0, "is_author": false, "is_subscribing": null, "subscriber_count": 359, "modified_text": "85 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "IPv4", "related_indicator_is_active": 0 }, { "id": "69054d860c50fd52320dcc8a", "name": "LCIA HoneyNet Data - November 2025 - Honeytrap", "description": "Data collected from honeypots in Louisiana. Just a fun project I tinker with.. data submitted with some gnarly python scripts for automation.", "modified": "2025-12-30T01:05:22.673000", "created": "2025-11-01T00:00:06.195000", "tags": [ "cowrie", "LAMP", "honeytrap", "malicious", "sftp", "ssh" ], "references": [ "https://github.com/telekom-security/tpotce" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dm_lacia", "id": "132921", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": {}, "indicator_count": 0, "is_author": false, "is_subscribing": null, "subscriber_count": 359, "modified_text": "117 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "IPv4", "related_indicator_is_active": 0 }, { "id": "690f19bfbd95aa1e708656c2", "name": "Scan port 8080 HTTP and proxy (S3#)", "description": "Scans hitting the server at TCP port 8080 HTTP and PROXY. Same IP should not appear more than once in 96 hours in our lists S3#.", "modified": "2025-12-08T10:03:27.178000", "created": "2025-11-08T10:21:51.372000", "tags": [ "tcp", "honeypot", "Malicious IP", "botnet", "mirai", "blacklist", "scan" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "BotnetExposer", "id": "80256", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_80256/resized/80/avatar_f1760e796f.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": {}, "indicator_count": 0, "is_author": false, "is_subscribing": null, "subscriber_count": 3163, "modified_text": "139 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "IPv4", "related_indicator_is_active": 0 }, { "id": "68e7a7b652c7d4d50bdadfd1", "name": "LCIA HoneyNet Data - October 2025 - Dionaea", "description": "Data collected from honeypots in Louisiana. Just a fun project I tinker with.. data submitted with some gnarly python scripts for automation.", "modified": "2025-11-30T23:04:34.666000", "created": "2025-10-09T12:16:54.148000", "tags": [ "dionaea", "ssh", "sip", "cowrie", "honeytrap", "cisco", "sftp", "sentrypeer", "tanner", "LAMP", "heralding", "malicious" ], "references": [ "https://github.com/telekom-security/tpotce" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dm_lacia", "id": "132921", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": {}, "indicator_count": 0, "is_author": false, "is_subscribing": null, "subscriber_count": 361, "modified_text": "146 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "IPv4", "related_indicator_is_active": 0 }, { "id": "68dc6f09e4749c34eb1da780", "name": "LCIA HoneyNet Data - October 2025 - Honeytrap", "description": "Data collected from honeypots in Louisiana. Just a fun project I tinker with.. data submitted with some gnarly python scripts for automation.", "modified": "2025-11-30T23:04:34.666000", "created": "2025-10-01T00:00:09.167000", "tags": [ "malicious", "honeytrap", "LAMP", "cisco" ], "references": [ "https://github.com/telekom-security/tpotce" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dm_lacia", "id": "132921", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": {}, "indicator_count": 0, "is_author": false, "is_subscribing": null, "subscriber_count": 363, "modified_text": "146 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "IPv4", "related_indicator_is_active": 0 }, { "id": "68dc7623f1dcfe701bea8be5", "name": "LCIA HoneyNet Data - October 2025 - ElasticPot", "description": "Data collected from honeypots in Louisiana. Just a fun project I tinker with.. data submitted with some gnarly python scripts for automation.", "modified": "2025-11-30T23:04:34.666000", "created": "2025-10-01T00:30:27.226000", "tags": [ "email", "tanner", "mailoney", "cowrie", "sentrypeer", "ssh", "LAMP", "cisco", "malicious", "sip", "Adbhoney", "sftp", "conpot", "heralding", "Redishoneypot", "dionaea", "elasticpot", "honeytrap" ], "references": [ "https://github.com/telekom-security/tpotce" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dm_lacia", "id": "132921", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": {}, "indicator_count": 0, "is_author": false, "is_subscribing": null, "subscriber_count": 361, "modified_text": "146 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "IPv4", "related_indicator_is_active": 0 }, { "id": "68dc7293c6af74c3829ffa10", "name": "LCIA HoneyNet Data - October 2025 - ConPot", "description": "Data collected from honeypots in Louisiana. Just a fun project I tinker with.. data submitted with some gnarly python scripts for automation.", "modified": "2025-11-30T22:01:06.641000", "created": "2025-10-01T00:15:15.678000", "tags": [ "conpot", "cowrie", "LAMP", "ipphoney", "sip", "honeytrap", "sftp", "malicious", "Adbhoney", "dionaea", "cisco", "sentrypeer", "tanner", "Redishoneypot", "ssh" ], "references": [ "https://github.com/telekom-security/tpotce" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dm_lacia", "id": "132921", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": {}, "indicator_count": 0, "is_author": false, "is_subscribing": null, "subscriber_count": 360, "modified_text": "146 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "IPv4", "related_indicator_is_active": 0 }, { "id": "68dc62ff34d0f2ab1014da50", "name": "HoneyPot Connect 01.10.2025", "description": "", "modified": "2025-10-31T00:03:36.521000", "created": "2025-09-30T23:08:47.008000", "tags": [ "HoneyNet Connect", "2025", "01.10.2025" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "Germany", "France", "United States of America", "Poland", "Finland" ], "malware_families": [], "attack_ids": [], "industries": [ "HoneyNet" ], "TLP": "green", "cloned_from": null, "export_count": 13, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "devnull0", "id": "259711", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_259711/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 186 }, "indicator_count": 186, "is_author": false, "is_subscribing": null, "subscriber_count": 50, "modified_text": "177 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "IPv4", "related_indicator_is_active": 0 }, { "id": "68da872b53e5cb3e57c44c9d", "name": "LCIA HoneyNet Data - September 2025 - Honeytrap", "description": "Data collected from honeypots in Louisiana. Just a fun project I tinker with.. data submitted with some gnarly python scripts for automation.", "modified": "2025-10-30T23:00:20.083000", "created": "2025-09-29T13:18:35.704000", "tags": [ "malicious", "LAMP", "honeytrap" ], "references": [ "https://github.com/telekom-security/tpotce" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dm_lacia", "id": "132921", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": {}, "indicator_count": 0, "is_author": false, "is_subscribing": null, "subscriber_count": 351, "modified_text": "177 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "IPv4", "related_indicator_is_active": 0 }, { "id": "68da01f6f9d2ffb7f1ece1ef", "name": "LCIA HoneyNet Data - September 2025 - Honeytrap", "description": "Data collected from honeypots in Louisiana. Just a fun project I tinker with.. data submitted with some gnarly python scripts for automation.", "modified": "2025-10-29T13:00:25.887000", "created": "2025-09-29T03:50:14.527000", "tags": [ "malicious", "honeytrap", "LAMP", "ssh", "sftp", "cowrie" ], "references": [ "https://github.com/telekom-security/tpotce" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dm_lacia", "id": "132921", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": {}, "indicator_count": 0, "is_author": false, "is_subscribing": null, "subscriber_count": 351, "modified_text": "178 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "IPv4", "related_indicator_is_active": 0 }, { "id": "68d6054431ba470e1a4774d8", "name": "LCIA HoneyNet Data - September 2025 - Honeytrap", "description": "Data collected from honeypots in Louisiana. Just a fun project I tinker with.. data submitted with some gnarly python scripts for automation.", "modified": "2025-10-28T04:00:13.396000", "created": "2025-09-26T03:15:16.592000", "tags": [ "sftp", "LAMP", "cowrie", "honeytrap", "ssh", "malicious", "dionaea" ], "references": [ "https://github.com/telekom-security/tpotce" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dm_lacia", "id": "132921", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": {}, "indicator_count": 0, "is_author": false, "is_subscribing": null, "subscriber_count": 351, "modified_text": "180 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "IPv4", "related_indicator_is_active": 0 }, { "id": "68b4e206bc3aff08bfb7710f", "name": "LCIA HoneyNet Data - September 2025 - Cowrie", "description": "Data collected from honeypots in Louisiana. Just a fun project I tinker with.. data submitted with some gnarly python scripts for automation.", "modified": "2025-10-27T12:02:27.575000", "created": "2025-09-01T00:00:06.530000", "tags": [ "LAMP", "ssh", "sftp", "malicious", "cisco", "honeytrap", "cowrie" ], "references": [ "https://github.com/telekom-security/tpotce" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 12, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dm_lacia", "id": "132921", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 8872 }, "indicator_count": 8872, "is_author": false, "is_subscribing": null, "subscriber_count": 362, "modified_text": "180 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "IPv4", "related_indicator_is_active": 0 }, { "id": "68b4e203fd27d31188fb2c9b", "name": "LCIA HoneyNet Data - September 2025 - Honeytrap", "description": "Data collected from honeypots in Louisiana. Just a fun project I tinker with.. data submitted with some gnarly python scripts for automation.", "modified": "2025-10-18T17:01:16.748000", "created": "2025-09-01T00:00:03.215000", "tags": [ "LAMP", "honeytrap", "malicious" ], "references": [ "https://github.com/telekom-security/tpotce" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 179, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dm_lacia", "id": "132921", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": {}, "indicator_count": 0, "is_author": false, "is_subscribing": null, "subscriber_count": 358, "modified_text": "189 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "IPv4", "related_indicator_is_active": 0 }, { "id": "688c03828a6810d2b845f1d3", "name": "LCIA HoneyNet Data - August 2025 - Honeytrap", "description": "Data collected from honeypots in Louisiana. Just a fun project I tinker with.. data submitted with some gnarly python scripts for automation.", "modified": "2025-09-30T23:04:08.766000", "created": "2025-08-01T00:00:02.861000", "tags": [ "honeytrap", "malicious", "LAMP" ], "references": [ "https://github.com/telekom-security/tpotce" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 14, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dm_lacia", "id": "132921", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": {}, "indicator_count": 0, "is_author": false, "is_subscribing": null, "subscriber_count": 358, "modified_text": "207 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "IPv4", "related_indicator_is_active": 0 }, { "id": "688c0388e444219a0b67459f", "name": "LCIA HoneyNet Data - August 2025 - Mailoney", "description": "Data collected from honeypots in Louisiana. Just a fun project I tinker with.. data submitted with some gnarly python scripts for automation.", "modified": "2025-09-30T22:06:20.481000", "created": "2025-08-01T00:00:08.082000", "tags": [ "ssh", "mailoney", "sftp", "malicious", "cowrie", "cisco", "email", "honeytrap", "LAMP" ], "references": [ "https://github.com/telekom-security/tpotce" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 12, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dm_lacia", "id": "132921", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": {}, "indicator_count": 0, "is_author": false, "is_subscribing": null, "subscriber_count": 362, "modified_text": "207 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "IPv4", "related_indicator_is_active": 0 }, { "id": "6861f02280d0adb339223f64", "name": "Automated Threat Intelligence - Scanning hosts for 2025-06-30", "description": "IPV4 hosts detected performing scans on production environment located in Australia.", "modified": "2025-09-28T00:00:13.359000", "created": "2025-06-30T02:02:10.595000", "tags": [ "scan", "ssh", "sip", "sipvicious" ], "references": [ "https://redpiranha.net" ], "public": 1, "adversary": "", "targeted_countries": [ "Australia" ], "malware_families": [], "attack_ids": [ { "id": "T1595", "name": "Active Scanning", "display_name": "T1595 - Active Scanning" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 14, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "redpiranha", "id": "17573", "avatar_url": "/otxapi/users/avatar_image/media/avatars/redpiranha/resized/80/rp_white_2_1920.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": {}, "indicator_count": 0, "is_author": false, "is_subscribing": null, "subscriber_count": 385, "modified_text": "210 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "IPv4", "related_indicator_is_active": 0 }, { "id": "686325055c0d5e89c0320c31", "name": "LCIA HoneyNet Data - July 2025 - Honeytrap", "description": "Data collected from honeypots in Louisiana. Just a fun project I tinker with.. data submitted with some gnarly python scripts for automation.", "modified": "2025-08-30T23:05:39.500000", "created": "2025-07-01T00:00:05.610000", "tags": [ "malicious", "dionaea", "heralding", "LAMP", "honeytrap" ], "references": [ "https://github.com/telekom-security/tpotce" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 16, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dm_lacia", "id": "132921", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": {}, "indicator_count": 0, "is_author": false, "is_subscribing": null, "subscriber_count": 360, "modified_text": "238 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "IPv4", "related_indicator_is_active": 0 }, { "id": "683e2ad4b6ebf2968271ef8a", "name": "LCIA HoneyNet Data - June 2025 - ElasticPot", "description": "Data collected from honeypots in Louisiana. Just a fun project I tinker with.. data submitted with some gnarly python scripts for automation.", "modified": "2025-07-30T23:03:36.012000", "created": "2025-06-02T22:51:00.261000", "tags": [ "tanner", "sip", "heralding", "LAMP", "email", "malicious", "sentrypeer", "conpot", "dionaea", "elasticpot", "honeytrap", "Redishoneypot", "cowrie", "sftp", "ssh", "ipphoney", "mailoney" ], "references": [ "https://github.com/telekom-security/tpotce" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 33, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dm_lacia", "id": "132921", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": {}, "indicator_count": 0, "is_author": false, "is_subscribing": null, "subscriber_count": 354, "modified_text": "269 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "IPv4", "related_indicator_is_active": 0 }, { "id": "683e2ac05e5ddafa0ea4bd8f", "name": "LCIA HoneyNet Data - June 2025 - Mailoney", "description": "Data collected from honeypots in Louisiana. Just a fun project I tinker with.. data submitted with some gnarly python scripts for automation.", "modified": "2025-07-30T23:03:36.012000", "created": "2025-06-02T22:50:40.984000", "tags": [ "sip", "LAMP", "email", "malicious", "sentrypeer", "honeytrap", "cowrie", "sftp", "ssh", "mailoney" ], "references": [ "https://github.com/telekom-security/tpotce" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 41, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dm_lacia", "id": "132921", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": {}, "indicator_count": 0, "is_author": false, "is_subscribing": null, "subscriber_count": 363, "modified_text": "269 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "IPv4", "related_indicator_is_active": 0 }, { "id": "683e2973e2acf620faa5753a", "name": "LCIA HoneyNet Data - June 2025 - Honeytrap", "description": "Data collected from honeypots in Louisiana. Just a fun project I tinker with.. data submitted with some gnarly python scripts for automation.", "modified": "2025-07-30T23:03:36.012000", "created": "2025-06-02T22:45:07.895000", "tags": [ "malicious", "ssh", "honeytrap", "heralding", "cowrie", "sftp", "LAMP" ], "references": [ "https://github.com/telekom-security/tpotce" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 39, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dm_lacia", "id": "132921", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": {}, "indicator_count": 0, "is_author": false, "is_subscribing": null, "subscriber_count": 360, "modified_text": "269 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "IPv4", "related_indicator_is_active": 0 }, { "id": "6836e0cd0237b2057b8cb2bf", "name": "Scan port 81 Skype (S3#)", "description": "Scans hitting the server at TCP port 81 Skype. Same IP should not appear more than once in 96 hours in our lists S3#.", "modified": "2025-06-27T10:03:56.895000", "created": "2025-05-28T10:09:17.605000", "tags": [ "tcp", "Skype", "honeypot", "Malicious IP", "botnet", "mirai", "blacklist", "scan" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 12, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "BotnetExposer", "id": "80256", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_80256/resized/80/avatar_f1760e796f.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": {}, "indicator_count": 0, "is_author": false, "is_subscribing": null, "subscriber_count": 3164, "modified_text": "303 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "IPv4", "related_indicator_is_active": 0 }, { "id": "6812b9840c0e32dc4052d2dd", "name": "LCIA HoneyNet Data - May 2025 - Cowrie", "description": "Data collected from honeypots in Louisiana. Just a fun project I tinker with.. data submitted with some gnarly python scripts for automation.", "modified": "2025-06-13T17:02:19.882000", "created": "2025-05-01T00:00:03.202000", "tags": [ "ssh", "cowrie", "sftp", "malicious" ], "references": [ "https://github.com/telekom-security/tpotce" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dm_lacia", "id": "132921", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 8140 }, "indicator_count": 8140, "is_author": false, "is_subscribing": null, "subscriber_count": 355, "modified_text": "316 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "IPv4", "related_indicator_is_active": 0 }, { "id": "68025b4dc8f6f95fe3715fb5", "name": "LCIA HoneyNet Data - April 2025 - Dionaea", "description": "Data collected from honeypots in Louisiana. Just a fun project I tinker with.. data submitted with some gnarly python scripts for automation.", "modified": "2025-05-30T23:01:38.602000", "created": "2025-04-18T14:01:49.181000", "tags": [ "ssh", "sftp", "dionaea", "malicious", "cowrie" ], "references": [ "https://github.com/telekom-security/tpotce" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dm_lacia", "id": "132921", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": {}, "indicator_count": 0, "is_author": false, "is_subscribing": null, "subscriber_count": 351, "modified_text": "330 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "IPv4", "related_indicator_is_active": 0 }, { "id": "680029bfb4e64e624934dbda", "name": "Scan port 8080 HTTP and proxy (S3#)", "description": "Scans hitting the server at TCP port 8080 HTTP and PROXY. Same IP should not appear more than once in 96 hours in our lists S3#.", "modified": "2025-05-16T22:02:23.964000", "created": "2025-04-16T22:05:51.142000", "tags": [ "tcp", "honeypot", "Malicious IP", "botnet", "mirai", "blacklist", "scan" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "BotnetExposer", "id": "80256", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_80256/resized/80/avatar_f1760e796f.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": {}, "indicator_count": 0, "is_author": false, "is_subscribing": null, "subscriber_count": 3163, "modified_text": "344 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "IPv4", "related_indicator_is_active": 0 } ], "references": [ "https://jamesbrine.com.au/digitaloceanlondon-portscan-bruteforce-ip-list-2026-04-24/", "https://github.com/telekom-security/tpotce", "https://jamesbrine.com.au", "https://redpiranha.net" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [], "malware_families": [], "industries": [ "Honeynet" ] } } }, "false_positive": [], "validation": [ { "source": "cloud", "message": "In cloud provider range: provider=azure", "name": "Cloud Provider IP range" } ], "asn": "AS8075 microsoft corporation", "city_data": true, "city": "San Antonio", "region": "TX", "continent_code": "NA", "country_code3": "USA", "country_code2": "US", "subdivision": "TX", "latitude": 29.4227, "postal_code": "78288", "longitude": -98.4927, "accuracy_radius": 1000, "country_code": "US", "country_name": "United States of America", "dma_code": 641, "charset": 0, "area_code": 0, "flag_url": "/assets/images/flags/us.png", "flag_title": "United States of America", "sections": [ "general", "geo", "reputation", "url_list", "passive_dns", "malware", "nids_list", "http_scans" ] }, "geo": { "asn": "AS8075 microsoft corporation", "city_data": true, "city": "San Antonio", "region": "TX", "continent_code": "NA", "country_code3": "USA", "country_code2": "US", "subdivision": "TX", "latitude": 29.4227, "postal_code": "78288", "longitude": -98.4927, "accuracy_radius": 1000, "country_code": "US", "country_name": "United States of America", "dma_code": 641, "charset": 0, "area_code": 0, "flag_url": "/assets/images/flags/us.png", "flag_title": "United States of America" }, "geo_ipapicom": { "country": "United States", "country_code": "US", "region": "Texas", "city": "San Antonio", "zip": "78288", "latitude": 29.4167, "longitude": -98.5, "timezone": "America/Chicago", "isp": "Microsoft Corporation", "org": "Microsoft Azure Cloud (southcentralus)", "asn": "AS8075 Microsoft Corporation", "asn_name": "MICROSOFT-CORP-MSN-AS-BLOCK", "is_proxy": false, "is_hosting": true, "source": "ip-api.com" }, "pulse_count": 42, "pulses": [ { "id": "5a64f74f0e543738c12bc973", "name": "Webscanners with Bad Requests - HTTP Status 400 - 1/20/2018 thru current day", "description": "Webscanners who's requests resulted in HTTP Status code 400 due to WAF rules or LB parsing issues", "modified": "2026-04-25T20:40:19.615000", "created": "2018-01-21T20:25:51.668000", "tags": [ "webscanner", "bruteforce", "badrequest", "probing", "webscan" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 385643, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "david3", "id": "2807", "avatar_url": "/otxapi/users/avatar_image/media/avatars/david3/resized/80/fireball-dwf.jpg", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 11243 }, "indicator_count": 11243, "is_author": false, "is_subscribing": null, "subscriber_count": 2578, "modified_text": "14 hours ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "IPv4", "related_indicator_is_active": 0 }, { "id": "69ec7a204b1d8d2b6371fe03", "name": "DigitalOcean London (UK) Port Scanning Hosts for 2026-04-24", "description": "IPv4 hosts detected port scanning DigitalOcean London (UK) honeypot", "modified": "2026-04-25T08:24:00.697000", "created": "2026-04-25T08:24:00.697000", "tags": [ "digital ocean", "portscan", "scanners", "honeypot" ], "references": [ "https://jamesbrine.com.au/digitaloceanlondon-portscan-bruteforce-ip-list-2026-04-24/", "https://jamesbrine.com.au" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "jamesbrine", "id": "83487", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_83487/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 3980 }, "indicator_count": 3980, "is_author": false, "is_subscribing": null, "subscriber_count": 1528, "modified_text": "1 day ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "IPv4", "related_indicator_is_active": 1 }, { "id": "697e9e9cd810b69811e492e0", "name": "Honeypot Data \u2013 T-Pot - Sydney, Australia - February 2026", "description": "Rolling monthly view for February 2026 of indicators observed by T-Pot CE honeypots. Each run looks back the last 24h and appends newly seen indicators for this month. Signals are deduped and filtered (min event count threshold; private IPs excluded). Intended for defensive use; infrastructure may be compromised or spoofed. Sensor: T-Pot CE. Location: Sydney, Australia.", "modified": "2026-04-01T23:56:12.846000", "created": "2026-02-01T00:30:20.205000", "tags": [ "tpot", "honeypot", "sensor-tagged", "cowrie", "suricata", "dionaea", "honeytrap", "p0f", "fatt", "mailoney", "tanner", "sentrypeer" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 12902, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "conrat45", "id": "280429", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_280429/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 154 }, "indicator_count": 154, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "24 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "IPv4", "related_indicator_is_active": 0 }, { "id": "697e97894fd746076df2a2a6", "name": "LCIA HoneyNet Data - February 2026 - Honeytrap", "description": "Data collected from honeypots in Louisiana. Just a fun project I tinker with.. data submitted with some gnarly python scripts for automation.", "modified": "2026-03-30T23:01:11.504000", "created": "2026-02-01T00:00:09.889000", "tags": [ "cowrie", "LAMP", "sip", "ssh", "cisco", "sftp", "sentrypeer", "honeytrap", "malicious" ], "references": [ "https://github.com/telekom-security/tpotce" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dm_lacia", "id": "132921", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": {}, "indicator_count": 0, "is_author": false, "is_subscribing": null, "subscriber_count": 357, "modified_text": "26 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "IPv4", "related_indicator_is_active": 0 }, { "id": "697e9788b7de070c0f68333b", "name": "Honeypot Data - February 2026 - Honeytrap", "description": "Data collected from honeypots in Louisiana. Just a fun project I tinker with.. data submitted with some gnarly python scripts for automation.", "modified": "2026-03-30T23:01:11.504000", "created": "2026-02-01T00:00:07.997000", "tags": [ "sip", "cisco", "LAMP", "sftp", "sentrypeer", "cowrie", "malicious", "honeytrap", "ssh" ], "references": [ "https://github.com/telekom-security/tpotce" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ladarrellmiller", "id": "111524", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": {}, "indicator_count": 0, "is_author": false, "is_subscribing": null, "subscriber_count": 435, "modified_text": "26 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "IPv4", "related_indicator_is_active": 0 }, { "id": "697e97b7b78ff64d0d1d4852", "name": "OpenCTI_Export_2026-02", "description": "Automated export from OpenCTI for 2026-02", "modified": "2026-03-30T19:03:16.662000", "created": "2026-02-01T00:00:55.684000", "tags": [ "OpenCTI", "Automated", "2026-02" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "info@watchtower365.com", "id": "67692", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 36525, "FileHash-SHA256": 3847, "domain": 1086 }, "indicator_count": 41458, "is_author": false, "is_subscribing": null, "subscriber_count": 36, "modified_text": "26 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "IPv4", "related_indicator_is_active": 0 }, { "id": "6955c00fc71c3eed5b3fa565", "name": "Honeypot Data \u2013 T-Pot - Sydney, Australia - January 2026", "description": "Rolling monthly view for January 2026 of indicators observed by T-Pot CE honeypots. Each run looks back the last 24h and appends newly seen indicators for this month. Signals are deduped and filtered (min event count threshold; private IPs excluded). Intended for defensive use; infrastructure may be compromised or spoofed. Sensor: T-Pot CE. Location: Sydney, Australia.", "modified": "2026-03-04T23:32:54.841000", "created": "2026-01-01T00:30:07.585000", "tags": [ "tpot", "honeypot", "sensor-tagged", "cowrie", "suricata", "dionaea", "honeytrap", "p0f", "fatt", "mailoney", "tanner", "sentrypeer" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 15130, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "conrat45", "id": "280429", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_280429/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 46, "FileHash-SHA256": 299 }, "indicator_count": 345, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "52 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "IPv4", "related_indicator_is_active": 0 }, { "id": "695f41d082836afadb04364e", "name": "Honeypot Data - January 2026 - Honeytrap", "description": "Data collected from honeypots in Louisiana. Just a fun project I tinker with.. data submitted with some gnarly python scripts for automation.", "modified": "2026-03-02T23:01:21.967000", "created": "2026-01-08T05:34:08.107000", "tags": [ "LAMP", "malicious", "honeytrap" ], "references": [ "https://github.com/telekom-security/tpotce" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ladarrellmiller", "id": "111524", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": {}, "indicator_count": 0, "is_author": false, "is_subscribing": null, "subscriber_count": 433, "modified_text": "54 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "IPv4", "related_indicator_is_active": 0 }, { "id": "695f24d7db4c0057d89f6bc3", "name": "LCIA HoneyNet Data - January 2026 - Dionaea", "description": "Data collected from honeypots in Louisiana. Just a fun project I tinker with.. data submitted with some gnarly python scripts for automation.", "modified": "2026-03-02T23:01:21.967000", "created": "2026-01-08T03:30:31.464000", "tags": [ "conpot", "honeytrap", "sftp", "malicious", "dionaea", "LAMP", "cowrie", "cisco", "ssh" ], "references": [ "https://github.com/telekom-security/tpotce" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dm_lacia", "id": "132921", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": {}, "indicator_count": 0, "is_author": false, "is_subscribing": null, "subscriber_count": 359, "modified_text": "54 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "IPv4", "related_indicator_is_active": 0 }, { "id": "6979ab617aff42b29f66fd28", "name": "LCIA HoneyNet Data - January 2026 - Honeytrap", "description": "Data collected from honeypots in Louisiana. Just a fun project I tinker with.. data submitted with some gnarly python scripts for automation.", "modified": "2026-03-02T23:01:21.967000", "created": "2026-01-28T06:23:29.109000", "tags": [ "LAMP", "honeytrap", "cowrie", "ssh", "heralding", "malicious", "sftp" ], "references": [ "https://github.com/telekom-security/tpotce" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dm_lacia", "id": "132921", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": {}, "indicator_count": 0, "is_author": false, "is_subscribing": null, "subscriber_count": 351, "modified_text": "54 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "IPv4", "related_indicator_is_active": 0 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "40.124.86.76", "type": "IPv4" }, "abuseipdb": { "indicator": "40.124.86.76", "abuse_score": 100, "verdict": "malicious", "total_reports": 214, "distinct_users": 64, "last_reported": "2026-04-26T11:04:42+00:00", "country_code": "US", "country_name": "United States of America", "isp": "Microsoft Corporation", "domain": "microsoft.com", "is_tor": false, "is_public": true, "is_whitelisted": false, "usage_type": "Data Center/Web Hosting/Transit", "recent_reports": [ { "date": "2026-04-26", "categories": [ "Port Scan" ], "comment": "tcp/1400", "reporter": "" }, { "date": "2026-04-26", "categories": [ "Port Scan" ], "comment": "tcp/20", "reporter": "" }, { "date": "2026-04-26", "categories": [ "Port Scan" ], "comment": "Blocked by UFW (TCP on 2380)\nSource port: 35381\nTTL: 51\nPacket length: 52\nTOS: 0x00\n\nThis report (for 40.124.86.76) was ", "reporter": "" }, { "date": "2026-04-26", "categories": [ "Port Scan" ], "comment": "tcp/2380 (2 or more attempts)", "reporter": "" }, { "date": "2026-04-26", "categories": [ "Port Scan" ], "comment": "Blocked by UFW (TCP on 2380)\nSource port: 51365\nTTL: 52\nPacket length: 52\nTOS: 0x00\n\nThis report (for 40.124.86.76) was ", "reporter": "" } ], "error": null }, "urlhaus": { "indicator": "40.124.86.76", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1777202262.590306 }